Loading story…
Polish healthcare software provider Qbusoft suffered a breach of its Medyc cloud platform after an attacker exploited an SQL-injection vulnerability in late August. The intruder exfiltrated an encrypted database archive containing personal data and may have accessed medical records, including records belonging to patients of Inowrocław’s Addiction and Psychiatric Treatment Center. Qbusoft detected the intrusion on September 9 and remediated the flaw.
Polish cybercrime, data-protection, and government authorities opened investigations, while criticizing Qbusoft’s initial failure to notify national incident-response bodies. An actor calling itself “fingerprint” claimed responsibility and alleged theft of data on 5 million patients and 8 million private photographs, but those claims are unverified and authorities have not publicly attributed the attack. The incident follows a separate recent breach of Poland’s MyDr medical system that reportedly exposed personal information for nearly 19,000 people.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
Qbusoft detected the Medyc intrusion overnight and fixed the exploited SQL injection vulnerability that day. It also restricted database permissions, rotated credentials, and added monitoring.
An unauthorized person exploited an SQL injection vulnerability in Qbusoft's Medyc application interface and exfiltrated an encrypted database archive. The platform is used by Polish healthcare providers for medical-records and practice-management functions.
A purported actor calling itself “fingerprint” contacted Zaufana Trzecia Strona and claimed responsibility, alleging theft of records for 5 million patients and 8 million private photographs. The claims were not independently verified, and Polish authorities made no public attribution.
Poland's Central Bureau for Combating Cybercrime began investigating the Medyc attack, the data-protection authority ordered an audit of the company behind Medyc, and the Digital Affairs Minister criticized Qbusoft for not initially reporting the incident to national response bodies.
The Addiction and Psychiatric Treatment Center in Inowrocław said attackers had run scripts targeting database tables containing medical information, making theft of medical records highly likely. Its affected Day Treatment Unit for Addiction Treatment held records for patients treated from July 2024 through August 2026.
A separate breach at Polish healthcare software provider MyDr preceded the Medyc incident. Authorities said it could involve data concerning approximately 19 million people and 12,000 healthcare organizations, while another report described exposure of personal information of nearly 19,000 people.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcemalware.news
Open sourcemedyc.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Polish authorities are investigating a cyberattack on healthcare software provider **MyDr** that may have exposed historical data tied to nearly **19 million people** and more than **12,000 medical facilities**. Prime Minister Donald Tusk said the breach was intended to extort a ransom, while officials stressed there is no indication that Poland’s public healthcare systems or the national **P1** electronic health platform were compromised. MyDr said it identified and removed the source of the incident, introduced additional security measures, and had found no evidence that the stolen data had been publicly released. As a precaution, Poland’s **e-Health Center** is replacing digital certificates used by medical systems to connect to the P1 platform, even though authorities said there is no evidence the certificates were stolen or abused. Regulators and security agencies are continuing to investigate the scope of the breach and identify those responsible, as the incident raises concern over the exposure of sensitive healthcare records and operational data across the country’s medical sector.
Aug 17, 2026
Polish healthcare software provider **MyDr** said it is investigating a serious security incident after alleged attackers claimed access to patient data from numerous clinics using its systems. According to reports, the threat actors said they obtained **18,814,422 unique PESEL numbers** from medical systems, raising the prospect of one of the country’s largest healthcare-related data exposures. Journalist Adam Haertle reportedly received the claim directly, attempted to validate it, and alerted the relevant authorities. Polish media and officials subsequently described the incident as a major breach affecting the medical data of roughly **19 million people**. MyDr is one of Poland’s largest electronic medical records providers, serving thousands of healthcare facilities and supporting millions of visits and prescriptions each month, which suggests the compromise could have broad downstream impact across clinics and patients if the attackers’ claims are confirmed.
Aug 13, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026