Background to the Incident
MyDr Limited Company is a Polish healthcare software provider. Its products include MyDr EDM (medical practice and facility management), Dr100 (dental practices and clinics), and the drNews information service. In January 2023, the company was acquired by the Docplanner Group - owner of the ZnanyLekarz brand - and became part of Poland's largest group providing software to doctors and patients. At the time of the acquisition, MyDr worked with approximately 47,000 doctors.
According to the company's own statements, the platform handles approximately 3 million appointments and 2.7 million prescriptions each month. Its solutions are used by around 12,000 healthcare providers. This single figure explains the full scale of the incident: over a period of several years, the system operationally "touches" a significant share of the country's population.
The company acted as a data processor within the meaning of the GDPR, while the individual healthcare facilities remained the controllers of patients' personal data. Those facilities had entrusted MyDr with processing the data under commercial agreements.
Concentration Risk as the Root Cause
The immediate cause of the incident was a technical vulnerability. The root cause was a market and regulatory decision that resulted in the medical data of more than a dozen million citizens being consolidated in the environment of a single private provider, without a certification requirement or defined minimum security standards for this category of processing.
Mirosław Wróblewski, President of Poland's Personal Data Protection Office (UODO), publicly stated that the data-processing architecture should be more distributed and decentralized specifically to reduce the risk of a catastrophic breach. He also emphasized that the MyDr case demonstrates the scale of the threat created when particularly sensitive data is consolidated in one place.
The 2024 Warning Sign - the eWUŚ Incident
The MyDr ecosystem had previously been exploited in a separate incident. In March 2024, the perpetrators took over medical staff accounts at healthcare facilities and used MyDr software as an intermediary tool. They ran a script that sent queries at scale to eWUŚ, the state system owned by Poland's National Health Fund (NFZ) and used to verify patients' entitlement to publicly funded healthcare. In this way, they obtained the data of more than 13 million citizens. After the President of the NFZ reported the anomaly in April 2024, the Central Cybercrime Bureau (CBZC) detained two people and secured the collected file; the data was not published online. As a systemic response, the NFZ introduced daily limits on eWUŚ queries submitted by external entities. It should be emphasized, however, that these were two entirely separate events. In 2024, the MyDr system was used as a tool to attack an NFZ resource; in 2026, it became the target itself. From a risk-management perspective, however, the same ecosystem had already been subject to serious abuse two years earlier, which should have raised the expected level of security maturity.
Incident Timeline
- 5 August 2026: The perpetrators send a message to the CEO of the company that owns the platform, including a link to a password-protected PDF containing "evidence." The matter is presented as an offer to purchase the results of a "security audit." The password to the file is the CEO's PESEL number.
- 8 August: The perpetrators contact the editorial team of Zaufana Trzecia Strona (ZTS). The publication notifies the relevant authorities.
- 10 August: MyDr announces that it is investigating a serious security incident. ZTS publishes an article at 6:30 p.m. The CBZC takes its first ex officio steps. Deputy Prime Minister Gawkowski reports the incident on X.
- 12 August: An emergency meeting of the Joint Cybersecurity Operations Centre is held at noon. After the meeting, the Deputy Prime Minister confirms the incident: nearly 19 million people, a database of more than 2 TB, and approximately 12,000 healthcare facilities. UODO issues its first statement. The CBZC opens a formal investigation supervised by the Warsaw Regional Prosecutor's Office. At approximately 3:00 p.m., the bezpiecznedane.gov.pl portal becomes unavailable under heavy user traffic.
According to the prosecutor's findings, the incident itself - unauthorized access to MyDr's IT system - occurred no later than 6 August 2026.
Scale of the Breach
According to official government statements, the cyberattack on MyDr's systems resulted in the theft of a database exceeding 2 TB (some sources report approximately 2.5 TB). Individuals claiming responsibility for the attack said they had accessed 18,814,422 unique PESEL numbers. The incident involved data originating from approximately 12,000 healthcare providers using the MyDr platform.
The categories of data likely stolen included:
- first and last names and dates of birth
- PESEL numbers
- phone numbers
- email addresses
- the patient's assigned NFZ region
- health data, including the contents of notes from medical appointments
- information about prescriptions and medications.
In its statements, MyDr emphasized that the data affected by the incident was "most likely historical" and dated from 2024 and earlier, meaning that it may not have included all of the company's customers and patients. A sample disclosed by the alleged perpetrators included a person's first and last name, date of birth, PESEL number, two phone numbers, NFZ region, and prescription information.
Technical Details of the Attack
According to an account provided to Zaufana Trzecia Strona by individuals claiming to be the perpetrators, the attack unfolded as follows:
- Remote code execution (RCE) was achieved through an XXE (XML External Entity) vulnerability in the handling of PKCS#12 certificates.
- This was used to obtain an API key for the organization's GitHub repository.
- The attackers gained access to the service's source code.
- Knowledge from the code and the credentials obtained were used to access the cloud infrastructure in Amazon Web Services.
The ZTS editorial team noted that it had been unable to verify this account independently. On 13 August, Deputy Prime Minister Gawkowski stated that the authorities already knew where the software error was located and which elements of the process and system management had failed, and that the vulnerabilities had been addressed. However, it was not disclosed whether he was referring to the vulnerability described above.
This is an almost textbook attack path: the compromise of a single application component leads to the theft of an API key; the key provides access to the code repository; and the repository exposes further credentials and architectural knowledge. It is a textbook example of the risks associated with machine identities and secrets stored in the runtime environment.
A breach of this volume should prompt serious reflection on the effectiveness of the safeguards in place. The President of UODO noted that downloading more than 2 TB does not happen in a second. The process must have taken days, and perhaps weeks. The fact that it was not detected early enough raises fundamental questions about the effectiveness of outbound-traffic monitoring, event correlation, and anomaly-detection mechanisms on the victim's side. This is one of the most important technical conclusions from the entire case: prevention failed, but the greatest failure was detection.
The Issue of Doctors' Certificates and the P1 System
The MyDr system required doctors to upload a certificate together with its password for issuing e-prescriptions. If the perpetrators obtained these certificates, they could potentially impersonate doctors in the central system. For this reason, on 14 August Poland's e-Health Centre and MyDr began a preventive, phased replacement of certificates used to communicate with the P1 system, which supports e-prescriptions, e-referrals, electronic medical records, and the Internet Patient Account. The Ministry of Digital Affairs emphasized that there were no findings indicating that P1 certificates had been compromised or used without authorization, and that the replacement was preventive. Independent experts advised doctors to revoke their old certificates and generate new ones themselves - a low-cost measure that could potentially limit the impact.
Profile of the Perpetrators
The perpetrators' operating model was not classic ransomware. There was no encryption of the environment or interruption to services. The attack relied solely on extortion based on a threat to disclose the data, presented to management as an "offer to purchase the results of a security audit." The perpetrators communicated in English, but their language and style suggested a deliberate attempt to conceal their tracks and mislead investigators about their origin. Deputy Prime Minister Gawkowski stated that, at that stage, there was no indication of a foreign actor's involvement. Both the company and the experts working with it said they were monitoring the dark web and had found no evidence that the data had been published. The President of UODO confirmed that the stolen data was circulating neither on the open internet nor on the dark web.
The "Cyber Five" - the Ministry of Digital Affairs' Legislative Proposal Package
In response to the crisis, the Ministry of Digital Affairs prepared a package of five legislative proposals called the "Cyber Five." The package is intended to address the systemic problem exposed by the MyDr case: in commercial agreements between IT providers and small healthcare facilities, responsibility for data security is sometimes transferred entirely to the weaker party - medical practices - even though the processor exercises actual control over the IT infrastructure. The proposed package consists of five security pillars.
Pillar 1 - Certification of Medical Data Processors
Only entities that meet defined security standards and additional requirements would be permitted to process medical data and access sensitive registers. Certification would be linked to the framework established by the Act on the National Cybersecurity Certification System.
Pillar 2 - Minimum Technology Requirements
Minimum requirements - including cybersecurity norms and standards - would be defined for IT and communications systems used to process medical data.
Pillar 3 - Transparency for Patients
Patients would have to be informed whenever the processing of their data is entrusted to external entities. They would receive information including the scope and purpose of the arrangement and the processor's contact details. The objective is to give citizens control over who has access to their data and to what extent.
Pillar 4 - Medical Event Notifications
Notifications would be introduced in the mObywatel and mojeIKP applications for medical events such as an appointment, a prescription being issued, or another healthcare service being provided. The notification itself would indicate that an event had occurred, while details would be available in the Internet Patient Account or mojeIKP. The mechanism is intended to enable rapid detection of attempts to use someone else's identity to obtain medicines or healthcare services fraudulently.
Pillar 5 - New Obligations for Large-Scale Data Processors
The rules would apply to entities providing data-processing services to more than 100 controllers or processing data relating to more than 100,000 people in total. Four measures are proposed:
- Immediate notification of CSIRT NASK, via the Police, of any data security breach. Data on the individuals affected - limited at minimum to first name, last name, and PESEL number - could then be made available through bezpiecznedane.gov.pl.
- Increased accountability for data processors.
- A mandatory risk assessment before processing begins, updated at least once every two years and after every material change in the method or conditions of processing.
- An obligation to provide controllers with the information needed to assess the level of security: safeguards applied, sub-processors, the location of data processing, and the results of audits, tests, and security assessments.
The proposals outlined above are still at the conceptual stage. The next step is expected to involve work on detailed legislative solutions and their implementation. No new legal obligations will arise until the legislation is enacted.
Business Takeaways and Key Recommendations
The MyDr case highlights a structural problem in controller-processor relationships in sectors where a fragmented customer base - numerous small practices - relies on a single centralized IT provider. The following takeaways and recommendations apply broadly to organizations that process personal data, particularly sensitive data, in cooperation with external IT service providers.
- Review data-processing agreements. Organizations should verify that their agreements with processors precisely allocate responsibility for technical security, regardless of each party's formal status. In the MyDr case, contractual responsibility rested entirely with the smaller medical practices, even though the provider controlled the infrastructure.
- Implement and regularly update risk assessments. In line with the scope of UODO's investigation, a key point is whether the risk assessment addressed real-world threats and whether its conclusions resulted in specific technical safeguards rather than merely formal documentation.
- Test safeguards regularly. Organizations processing data at scale should implement recurring penetration tests and security audits. The lack of regular security verification is one of the main areas being examined by the regulator in the MyDr case.
- Ensure transparency across the data-processing chain. Companies should inform customers - and their customers' end users - in advance about every entity involved in processing the data, including sub-processors such as cloud providers, in line with the direction of the proposed Cyber Five legislation.
- Obtain security certification for large-scale data processors. Particularly in regulated sectors such as healthcare, finance, and energy, certification under Poland's National Cybersecurity System or standards such as ISO 27001 should become standard practice ahead of forthcoming legal requirements.
- Establish notification procedures and incident readiness. Organizations should have procedures in place to quickly identify the scope of a breach and notify controllers and affected individuals. In the MyDr case, a significant challenge was determining which patients and which data categories were affected, delaying the notification process required by the GDPR.
- Segment and minimize data. Limiting the amount of historical data retained - MyDr stated that the leaked data dated from 2024 and earlier - reduces the potential scale of harm in the event of a breach.
- Maintain a crisis communication plan. Rapid, consistent, and precise communication with customers, patients, and supervisory authorities minimizes reputational and legal risk. In the MyDr case, criticism focused both on delays in providing information and on the lack of support for smaller healthcare facilities in meeting their notification obligations.
