Poland's MyDr Breach Exposes Health Records of 18.8 Million Citizens
A massive cybersecurity failure has compromised nearly half of Poland's population, leaking sensitive medical histories and social security numbers.
Poland is grappling with a massive cybersecurity failure after hackers breached MyDr, the nation's leading medical platform. The incident exposed the sensitive health records of approximately 18.8 million citizens, representing nearly half of the country's population.
According to reports from Cybernews, attackers exfiltrated over 2.5 terabytes of medical information. The stolen dataset includes personally identifiable information (PII), doctor appointment histories, medical prescriptions, and PESEL numbers—the unique social security identifiers used across Poland. To demonstrate the scale and validity of the breach, the hackers leaked the personal details and prescriptions of a high-ranking Polish politician.
The Role of MyDr
MyDr serves as Poland's primary healthcare infrastructure, acting as a central hub for patients to schedule appointments, access medical records, and receive digital prescriptions. The platform's reach is extensive, partnering with tens of thousands of clinics across the country. While the exact timeline of the intrusion remains under investigation, evidence suggests the breach likely dates back to 2024 and earlier.
Implications of Medical Data Theft
The compromise of health data is particularly severe because, unlike passwords or credit card numbers, medical histories are non-recoverable. Once a patient's diagnosis or prescription history is public, it cannot be reset. This vulnerability creates a long-term risk of medical identity theft and insurance fraud. Furthermore, the exposure of private health data provides a potent tool for the blackmail of both private citizens and public figures.
Government Response
Polish officials have reacted with urgency to the scale of the disaster. Krzysztof Gawkowski, the Deputy Prime Minister and Minister of Digital Affairs, described the event as "one of the largest data leaks in history." Gawkowski issued a stern warning to the perpetrators, stating that "anyone behind this attack must be aware that the ruthlessness of the Polish services will be final."
What's Next
Authorities are now working to determine the full extent of the data's distribution and whether other healthcare providers were affected through MyDr's extensive clinic network. While the government has vowed a rigorous pursuit of the attackers, millions of citizens remain at risk as the stolen 2.5 terabytes of data circulate in the digital underground.