Poland probes MyDr breach, rotates P1 connection certificates. Last updated: August 25, 2026 4:21 am Poland is investigating a cyber incident at healthcare-software provider MyDr that authorities say may involve data connected to nearly 19 million people. The government has also begun replacing certificates used by medical systems to connect to the national P1 electronic-health platform, a precaution intended to protect the wider healthcare network rather than evidence that P1 itself was compromised. The case has put unusually sensitive information at the center of a supplier breach: MyDr software is used by doctors, clinics and other providers, and its systems connect providers to the infrastructure behind electronic prescriptions and referrals. MyDr says it removed the cause of the incident, added security measures and remains operational. Investigators have not publicly identified an attacker, an intrusion method or the final scope of data accessed. Table of Contents Large figure is not yet a count of affected people. The headline number needs careful reading. In an initial public account on August 12, Digital Affairs Minister Krzysztof Gawkowski said the incident could affect nearly 19 million people. Reporting by UNN said the minister described 19 million records as having been taken and put the volume above 2 terabytes. A record total is not the same thing as a verified number of unique people. A healthcare-software environment can hold multiple entries for one person, historical records, administrative data and data associated with providers. Authorities have also said the unauthorized access involved historical data held in MyDr systems through April 2024 and may not involve every MyDr customer or patient. That distinction is more than statistical housekeeping. It means the available information supports describing nearly 19 million as a potential exposure figure, not as proof that the personal data of 19 million distinct Polish residents was stolen. MyDr serves more than 12,000 medical facilities, according to authorities, which explains why an incident at one vendor can produce a national-scale estimate. People claiming responsibility have separately asserted that they hold data on 18.8 million people and more than 2.5 terabytes of material. Those claims, reported by IT Nerd, have not been independently verified. The difference between the government's reported volume and the alleged attackers' larger figure is unresolved. Possible health and identity data remain under review. Reports based on purported samples supplied by those claiming responsibility suggest that names, dates of birth, Polish identification numbers, prescription details and other medical information may be among the material accessed. But neither the authenticity of the samples nor the full set of affected data fields has been independently established. MyDr has said it found no evidence that affected data had been published or otherwise made publicly available. That sits uneasily with reports that alleged attackers showed journalists limited evidence, but it does not establish that a complete dataset has been released. A purported sample, even if genuine, cannot by itself show the size, completeness or circulation of a stolen collection. The cause is similarly unsettled. Gawkowski initially said there were no indications of an external attack and listed possibilities including human error, system failure, sabotage or negligence. By August 14, MyDr had characterized the event as external and intentional criminal activity, according to later reporting. The Record reported that the company said it had identified and removed the cause and was cooperating with authorities. Those accounts establish that the investigation evolved; they do not yet settle how access was gained. Why Poland is rotating P1 certificates. MyDr's connection to P1 raised a second operational concern. P1 is Poland's nationwide electronic-health platform, supporting services including e-prescriptions and electronic referrals. Medical software connects to it using certificates, digital credentials that help a system establish that it is authorized to communicate with the platform. The e-Health Center is replacing those connection certificates as a precaution. Officials said they had found no evidence that the certificates were stolen or misused, and Health Minister Jolanta Sobierańska-Grenda said P1 remained secure. Authorities also said the replacement should not interrupt patient-facing services such as prescriptions and referrals. The action is therefore best understood as containment around a trusted connection, not as confirmation that a national platform was breached. Certificate replacement can limit risk if credentials might have been exposed in a vendor environment, while preserving the ability of authorized medical systems to reconnect under new credentials. It does not reveal whether the MyDr incident involved credentials at all. Regulators and cybercrime investigators take up the case. Poland's Personal Data Protection Office plans to inspect MyDr, while security agencies and the Central Bureau for Combating Cybercrime are seeking to identify those responsible. The inquiry will need to establish which systems were accessed, whether any data was removed, how many people can be linked to the records and whether affected providers or patients require further notification. For now, the firmest points are narrower than the most dramatic claims: a major healthcare supplier suffered an incident affecting historical data; the possible scale is substantial but unfinalized; and Poland has protected a linked national-health connection despite saying the P1 platform is secure. The unanswered questions are precisely the ones that will determine the breach's real impact. Bill Thompson is a veteran technology columnist and digital culture analyst with decades of experience reporting on the intersection of media, society, and the internet. His commentary has been featured across major publications and global broadcasters. Known for exploring the social impact of digital transformation, Bill writes with a focus on ethics, innovation, and the future of information.

Hack on med software firm hits half of Poland's population. 19M Patients Affected by Data Theft Including National ID Numbers Marianne Kolbasuk McGee (HealthInfoSec) - August 17, 2026 A hack into IT systems of MyDr, a Polish provider of electronic medical documentation software, has affected more than 12,000 healthcare facilities and nearly 19 million people in Poland, about half the country's population. Government authorities said they launched an investigation Aug. 12 into the alleged 2.5 terabyte data theft incident, in which cybercriminals appeared to have gained access into MyDr's IT environment no later than Aug. 6. Among other sensitive personal and health information, the incident compromised citizens' PESEL numbers, which are akin to Social Security numbers in the United States - except the PESEL, a unique identifier for an individual's lifetime, is used more extensively, including for everyday tasks such as rentals and utilities. "Our investigation indicates that the data involved in the incident is likely historical, dating back to 2024 and earlier. We are continuing to verify the scope of the incident and will provide further information as the investigation progresses," MyDr said in a statement. Poland's Central Bureau for Combating Cybercrime, which is investigating the incident, said an unidentified person obtained unauthorized access through the internet to all or part of the IT system administered by MyDr and information stored on servers that are part of the company's infrastructure. That included personal data of patients of healthcare entities that are MyDr clients. Besides patients' PESEL numbers, affected information includes names, telephone numbers, e-mail addresses and data about health conditions, such as the content of notes from doctor's visits or information on issued prescriptions. MyDr in a statement provided to ISMG on Monday said that "as of now," the company's systems "are fully operational and secure to use for both patients and doctors." Investigators are actively monitoring the darkweb and have confirmed that there is no evidence of any MyDr data having been published or publicly available, the statement said. "We cannot confirm the amount and type of data that has been leaked. We will do it once the forensic investigation is over. At this stage, the full analysis of the incident's root cause has not yet been completed," the statement said. "A detailed investigation is ongoing, including a forensic examination conducted by engaged external experts. Until these activities have been concluded, it would be premature to identify a specific cause of the incident or to determine which of the currently considered hypotheses is supported by the evidence gathered to date." Polish officials on Aug. 12 said they estimate the incident may have affected 18.8 million people and over 12,000 medical facilities. Poland's 2026 total population is about 37.7 million. The incident under investigation is punishable by imprisonment for up to three years, Polish government officials said. 'An attractive target' MyDr says its flagship all-in-one platform, MyDr EDM, provides a suite of functionalities for the daily work of healthcare facilities, including an electronic health record, scheduling, electronic prescription, e-referral, e-sick leave modules and telemedicine. The software is fully integrated with the Polish government's P1 Platform, which is the national electronic health system used to collect, analyze and share digital medical data across country. "While MyDr EDM is not the official electronic health record for Poland, it has been widely adopted by much of the country's population," said Damon Small, a board member of security firm Xcape. "Because of the large number of records stored in this system, it is a treasure trove of sensitive information that can be used for extortion and identity theft," he said. While MyDr EDM supports multi-factor authentication, it's not required, Small said. "Users must manually enable that security feature," Small said. "This, compounded with the fact that some 12,000 healthcare providers and 47,000 doctors' offices use this system, making it an aggregation point for millions of Poles and an attractive target." Polish cybersecurity company Zaufana Trzecia Strona in an Aug. 10 blog post wrote that the alleged MyDr hackers reached out to the cyber firm claiming they gained access to MyDr's IT environment via a "remote code execution through an XXE vulnerability in PKCS#12 certificate handling. This allowed the hackers to obtain the GitHub API key, where they in turn found the service's source code. This allowed them to access the AWS infrastructure." The security firm added that it has been able to independently verify the hackers' claims. But if those claims are true, "the entry bug is a fairly common attack chain these days, and much of this boils down to a very long-lived credential sitting where a compromised application could read it," Denis Calderone, CTO of security firm Suzu Labs told ISMG. While the threat actors have not been publicly identified, the incident does not yet appear to be politically motivated, Small said. "The breadth of data exfiltrated suggests opportunistic criminals that will likely use this data for identity theft or to sell to unscrupulous third-party buyers. That data commands a handsome price and can be leveraged for insurance fraud, for example," he said. Too much data on one platform? Some experts said the volume of data stolen and the incident's impact to so many is especially concerning. "This event proves that when a healthcare platform centralizes prescriptions, national ID numbers and appointment histories for tens of millions of people, the stakes of a compromise are extraordinary," said Seemant Sehgal, CEO and founder, security firm BreachLock. "The question becomes how can one platform come to hold that much sensitive data without adequate guardrails between it and the outside world," Sehgal said. "The scale of the reported data and the evidence of access raise serious questions about how long attackers may have been inside the environment and what signals could have been missed along the way," he said. Right now, the hack on MyDr in Poland is being compared to similarly large breaches in the U.S. affecting health information - including the 2024 ransomware and data theft incident involving UnitedHealth Group's Change Healthcare IT services unit. "Change affected 192.7 million people, close to 57% of the U.S. population, and the MyDr claim works out to roughly half of Poland's," Calderon said. "Where the two countries diverge is regulatory maturity," he said. "HIPAA has spent more than a decade defining what a business associate owes the providers it serves and putting a clock on breach notification, while Poland only implemented NIS2 into national law on April 3 of this year, and healthcare entities there don't even have to register until October."