CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

MyDr electronic health record platform breach (Poland, 2026)

incident · incident:mydr-poland-ehr-breach-2026

Intrusion into MyDr, one of Poland's largest electronic medical record platforms, serving thousands of healthcare facilities. The company confirmed on 12 August 2026 that it had been the target of a deliberate external criminal act affecting part of its data, likely historical data from 2024 and earlier, and that it could not yet state the quantity or type of data involved. People presenting as the perpetrators claim 18,814,422 unique PESEL national identity numbers and 2.5 TB of data, and describe an access chain (remote code execution via an XXE flaw in PKCS#12 certificate handling, then a GitHub API key, source code and AWS infrastructure) that the reporting outlet states it could not independently verify. Because MyDr is a GDPR processor and the controllers are thousands of individual clinics, affected individuals cannot be notified centrally (MyDr, 2026-08-12; Zaufana Trzecia Strona, 2026-08-10).

Aliases: MyDr PESEL breach, wyciek danych MyDr

Coverage
2
first 2026-08-13 → last 2026-09-30
Latest activity
2026-09-27
A second Polish health-records vendor is breached by what Zaufana Trzecia Strona says is the MyDr actor
Peak priority
high
1 high · 1 routine
Targets
healthcare
sectors: healthcare, public-sector · regions: europe
Sources cited
10
6 hosts
2026-08-132 appearances2026-09-27

Defender insights

What each entry about MyDr electronic health record platform breach (Poland, 2026) tells a defender to do, newest first.

2026-08-13HIGHA Polish health-records processor confirms an intrusion, and because it is not the data controller it cannot tell the affected people

Latest update

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed to

Story timeline

  1. 2026-09-27Qbusoft's Medyc practice-management software, used by Polish healthcare providers, is breached via SQL injection, and Zaufana Trzecia Strona attributes it to the actor behind August's MyDr leak
    active-threatsA second Polish health-records vendor is breached by what Zaufana Trzecia Strona says is the MyDr actor
  2. 2026-08-13MyDr, a Polish electronic health record platform serving thousands of clinics, confirms a deliberate criminal intrusion, and because it is a processor, not a controller, the people affected cannot be told directly
    active-threatsA Polish health-records processor confirms an intrusion, and because it is not the data controller it cannot tell the affected people

Hunting pivots

Tags
data-breach ×2organized-crime ×2sqli
ATT&CK techniques (5 across 6 tactics)

5 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Valid Accounts: Cloud Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts · Valid Accounts: Cloud Accounts
  • Privilege EscalationValid Accounts · Valid Accounts: Cloud Accounts
  • StealthValid Accounts · Valid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials: Credentials In Files
  • CollectionData from Information Repositories

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-27/qbusoft-medyc-poland-healthcare-breach-fingerprint-actor · 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×2

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-09-27/qbusoft-medyc-poland-healthcare-breach-fingerprint-actor · 2026-08-13/mydr-poland-ehr-criminal-intrusion-confirmed-processor-gap · ATT&CK page ↗

Entries about MyDr electronic health record platform breach (Poland, 2026) (2)

2026-09-27 · view entry permalink →

ROUTINEupdatedNATOB2

Qbusoft's Medyc practice-management software, used by Polish healthcare providers, is breached via SQL injection, and Zaufana Trzecia Strona attributes it to the actor behind August's MyDr leak

Qbusoft, maker of the Medyc practice-management application used by Polish clinics, was breached through SQL injection on 22-23 August 2026 and an encrypted database archive was taken. The company learned of it only in the night of 8-9 September, and the breach surfaced through a patient notice from the Inowrocław addiction and psychiatric treatment centre. Name, surname and PESEL were stored encrypted, but the vendor told the facility the encryption was easy to break (Zaufana Trzecia Strona, 2026-09-24).

Zaufana Trzecia Strona attributes the intrusion to "fingerprint", the pseudonym of the actor behind August's MyDr breach (Zaufana Trzecia Strona, 2026-09-24), which exposed data on almost 19 million Poles (TVP World, 2026-09-25). DataBreaches.net notes that whether it is the same attacker has not been disclosed (DataBreaches.net, 2026-09-26). The attackers claim data on five million patients, against ZTS's own estimate of at least a million, and 8 million photos, a count ZTS could not confirm. Poland's digital affairs minister said Qbusoft reported the intrusion to the Central Office for Combating Cybercrime but not to the healthcare-sector CSIRT CEZ or to CERT Polska (Zaufana Trzecia Strona, 2026-09-25).

According to information we have, a new large leak of personal and medical data has occurred, this time from the systems of Qbusoft Sp. z o.o., the maker of the Medyc.pl practice application. The perpetrators of the leak are the same people who were behind the attack on the MyDr systems, from which the data of over 18 million Poles was stolen. (translated from Polish)

The Addiction and Psychiatric Treatment Center in Inowrocław reported having received information about a leak of its patients' data from the Medyc system (the same center had earlier reported a leak of its patients' data from the MyDr system, which is bad luck). (translated from Polish)

As we read in the Inowrocław facility's own notice, the attack on Qbusoft took place on 22-23 August of this year. The perpetrators, using an SQL Injection vulnerability, stole an "encrypted database archive." The company learned of the incident on the night of 8-9 September. (translated from Polish)

we ourselves assessed the scale of the incident at at least a million people; according to the perpetrators it is five million. The perpetrators also mention that they stole 8 million "very private" photos. (translated from Polish)

The incident at Qbusoft was also confirmed by Minister Gawkowski, who pointed out that although the victim of the attack informed the Central Office for Combating Cybercrime about it, it did not pass information to either the CSIRT CEZ team, established to handle incidents in the healthcare sector, or to the CERT Polska team, which coordinates the largest incidents and has the greatest experience in Poland in this regard (it handled, among others, the coordination of the incident at MyDr). (translated from Polish)

Zaufana Trzecia Strona 2026-09-24

Whether it’s the same attacker or whether any ransom demand has been involved has not been disclosed.

DataBreaches.net 2026-09-26
Correctionrun 2026-09-30T0639Z-auditprioritysourcing_notetitleheadlinesummarybody

The link between the Medyc and MyDr breaches is Zaufana Trzecia Strona's attribution (Zaufana Trzecia Strona, 2026-09-24). DataBreaches.net notes that whether it is the same attacker has not been disclosed (DataBreaches.net, 2026-09-26). The earlier title and headline stated the link as fact. The earlier headline also said the vendor never told the national CERT. The minister's statement relayed by Zaufana Trzecia Strona says that, as of 2026-09-25, the information had not been passed to CSIRT CEZ or CERT Polska (Zaufana Trzecia Strona, 2026-09-25).

Builds on: A Polish health-records processor confirms an intrusion, and because it is not the data…

incident27 Sep 04:34Zmulti-sourceOpen finding →
Sources: Zaufana Trzecia Strona · TVP World · DataBreaches.net

2026-08-13 · view entry permalink →

HIGHupdatedNATOB2

MyDr, a Polish electronic health record platform serving thousands of clinics, confirms a deliberate criminal intrusion, and because it is a processor, not a controller, the people affected cannot be told directly

MyDr serves thousands of Polish healthcare facilities and, on figures the company itself gives, processes three million appointments and 2.7 million prescriptions a month (Zaufana Trzecia Strona, 2026-08-10). It published an incident statement updated 2026-08-12 at 18:35 CET confirming an intrusion: "Na tym etapie trwającego dochodzenia potwierdzamy, że staliśmy się celem zewnętrznego, celowego działania o charakterze przestępczym, którym objęta była część danych"; at this stage of the ongoing investigation we confirm that we became the target of an external, deliberate act of a criminal nature, which covered part of the data (MyDr, 2026-08-12). The company states the affected data is most likely historical, from 2024 and earlier, and may not cover all MyDr clients or all their patients; that its systems are fully operational and safe to use; that its cybersecurity partners monitoring the dark web have found no evidence the data has been published or shared publicly; and that it cannot yet confirm the quantity and type of data disclosed until forensic analysis completes (MyDr, 2026-08-12).

The claims that prompted the statement are considerably larger. People presenting themselves as the perpetrators contacted Polish security journalist Adam Haertle before the disclosure and said they hold 18,814,422 unique PESEL national identity numbers and 2.5 TB of data (Zaufana Trzecia Strona, 2026-08-10). The outlet's verification is careful and worth reading as a method rather than a verdict: it was sent a database record for a senior Polish politician whose date of birth, identity number, name and one of two phone numbers it independently confirmed, along with the correct national health-fund region; it asked the claimants to look up the identity numbers of four industry volunteers and received records for two, which with the author's own record makes three matches out of five checked. The outlet states it caught the claimants in no inconsistency within what it could check, while being explicit that its checking ability is limited and that it has no way to verify either the 2.5 TB volume or the 18-million figure, though it observes that the figure is consistent with the potential reach of a system serving thousands of practices. It also records that Gawkowski, whom it names as premier, wrote publicly that much suggests an unauthorised person may have gained access to the data.

The access chain is a lead, not a finding. Per the claimants' own account, they first obtained remote code execution through an XXE-class flaw in the handling of PKCS#12 certificates ("Według tego, co usłyszeliśmy od sprawców, najpierw udało im się uzyskać zdalne wykonanie kodu przez podatność typu XXE przy obsłudze certyfikatów PKCS#12") which yielded a GitHub API key, from there the platform's source code, and from there the AWS infrastructure. The outlet's next sentence is the one that governs how this should be read: "Nie byliśmy w stanie niezależnie zweryfikować tych informacji"; we were not able to independently verify this information (Zaufana Trzecia Strona, 2026-08-10). MyDr says it cannot share technical details while the investigation runs. No CVE exists and no vendor has confirmed a vulnerability class; treat the chain as an unverified attacker narrative that is nonetheless a reasonable thing to check for in your own certificate-parsing paths.

The extortion mechanics are documented more solidly, because the outlet handled the artefacts. The claimants sent the company's chief executive a message on 5 August linking to a PDF that was supposed to self-delete after download and did not; the file was password-protected, and the claimants noted the password was the executive's own PESEL number, which the outlet points out is a low-entropy value and therefore no obstacle. The document framed the approach as an offer to purchase the results of a security audit, and contained internal corporate correspondence including personnel information and a whistleblower report, alongside a fragment of the company's partner-doctor database. The claimants also showed a message sent to company employees from the company's own bulk-SMS account, and named Jira and a HubSpot CRM among systems they say they reached in full (Zaufana Trzecia Strona, 2026-08-10). On attribution the outlet is deliberately unhelpful in the right way: the claimants write in English, use a Russian-style emoticon convention, and produce English that reads as though deliberately rewritten to imitate a non-native speaker from elsewhere, which it reads as an attempt to lay false trails.

The structural finding, and the reason this matters beyond Poland. MyDr cannot tell affected people they are affected. "MyDr jest jedynie "podmiotem przetwarzającym" zgodnie z RODO, a administratorem danych są placówki ochrony zdrowia, których są tysiące"; MyDr is only a processor under GDPR, and the controllers are the healthcare facilities, of which there are thousands (Zaufana Trzecia Strona, 2026-08-10). The outlet's assessment is that individuals therefore have no way to check their own exposure and must wait for MyDr to determine scope, notify each facility, and for each facility to notify its own patients; a chain it expects to take many days. MyDr's own statement is consistent with this: it says it will contact affected clients proactively once it establishes which facilities and which data are involved, will support them in reporting to the data-protection authorities and in patient communication, and that no reports from facilities are required at present.

Na tym etapie trwającego dochodzenia potwierdzamy, że staliśmy się celem zewnętrznego, celowego działania o charakterze przestępczym, którym objęta była część danych.

MyDr (company incident statement) 2026-08-12

Według tego, co usłyszeliśmy od sprawców, najpierw udało im się uzyskać zdalne wykonanie kodu przez podatność typu XXE przy obsłudze certyfikatów PKCS#12.

Nie byliśmy w stanie niezależnie zweryfikować tych informacji.

MyDr jest jedynie "podmiotem przetwarzającym" zgodnie z RODO, a administratorem danych są placówki ochrony zdrowia, których są tysiące.

Zaufana Trzecia Strona 2026-08-10

“We are dealing with one of the largest incidents in Poland’s history,” said digital affairs minister Krzysztof Gawkowski on Wednesday.

Notes from Poland 2026-08-13

„Powiadomienia osób, dotkniętych wyciekiem danych, spoczywa na administratorach, którzy korzystali z usług spółki MyDr” - zwrócił uwagę Urząd.

Gazeta Prawna 2026-08-13
Updaterun 2026-08-15T0412Z-intelevidencesourcestechniquesbody

The earlier entry recorded MyDr's own confirmation of a deliberate external criminal act, its statement that it could not yet say what was taken, and the structural observation (made at the time by the reporting outlet rather than by any authority) that because MyDr is a processor and the controllers are thousands of individual healthcare facilities, affected people could not be notified centrally. Both halves have now been settled by the Polish state.

At a press briefing following a meeting of the Joint Cybersecurity Operations Centre, Deputy Prime Minister and digital affairs minister Krzysztof Gawkowski said the leak may cover nearly 19 million people and that the stolen database exceeds 2 TB (Gazeta Prawna, 2026-08-13), and characterised it as "one of the largest incidents in Poland's history" (Notes from Poland, 2026-08-13). That replaces MyDr's hedged position with a government-stated figure. Gawkowski also said there is no indication of an attack from Russia or another state and that cybercriminals are "very likely" responsible; a notable framing for a country whose public sector is regularly targeted by state-linked actors, and one that shapes what kind of follow-on activity defenders should expect. Around 12,000 medical facilities use MyDr's services, per the digital affairs ministry (Notes from Poland, 2026-08-13). MyDr said in a Wednesday update that at the time of writing there was no evidence the data had been published anywhere.

The regulator has now put the notification structure in writing. Poland's data protection authority UODO stated that the obligation to notify people affected by the leak rests with the controllers that used MyDr's services, and reminded controllers that under GDPR a breach must be reported to the supervisory authority without undue delay and where feasible no later than 72 hours after becoming aware of it, with a reasoned explanation attached to any later report (Gazeta Prawna, 2026-08-13). UODO's advice to individuals is to lock their PESEL national identity number and to treat incoming SMS and email with more care to avoid phishing aimed at extracting further data or access to banking. Gawkowski separately urged people to use state services to check exposure and to lock their PESEL through the mObywatel portal (Notes from Poland, 2026-08-13).

Improvementrun 2026-09-27T0404Z-intelentitiesbody

Zaufana Trzecia Strona's reporting on a second Polish healthcare-software vendor breach, at Qbusoft (maker of the Medyc practice-management application), names the pseudonymous actor behind that intrusion as "fingerprint," the same party the outlet states was behind this MyDr breach (Zaufana Trzecia Strona, 2026-09-24). The attribution rests on ZTS's own reporting and has not been independently confirmed by a second assessor; the Qbusoft/Medyc incident is covered separately.

incident13 Aug 05:05Zmulti-sourceOpen finding →
Sources: MyDr (company incident statement) · Zaufana Trzecia Strona · DataBreaches.net · Notes from Poland · Gazeta Prawna

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2

Source distribution

  • zaufanatrzeciastrona.pl4 (40%)
  • databreaches.net2 (20%)
  • gazetaprawna.pl1 (10%)
  • notesfrompoland.com1 (10%)
  • pro.mydr.pl1 (10%)
  • tvpworld.com1 (10%)
All cited sources (10)