Polish Hospital Reports No Evidence of Data Theft After 2023 Ransomware Attack
Summary
A Polish hospital says investigations found no evidence that patient or staff data were exfiltrated after a March 2023 ransomware incident encrypted archived records. Theft remains unconfirmed; the affected server was disabled.
Key points
- The hospital says a ransomware infection on March 3, 2023, encrypted files on a computer holding an archived patient database at its mental health center in Drawsko Pomorskie.
- An update dated May 5, 2026, says the CBZC investigation and technical analyses by CSIRT and NASK found no evidence that patient or staff data left the hospital network.
- The hospital says it cannot conclusively determine whether data were stolen; its notice describes potential exposure of identifying, contact, medical, and other sensitive information.
- The infected server was taken out of service, other computers were checked for similar infections, and authorities were notified.
- The hospital advises affected people to watch for misuse of their information, secure their PESEL number, and use other identity and account-protection measures.
Article Details
- Victim Organization
- SP ZOZ Szpital Specjalistyczny MSWiA w ZÅocieÅcu, including its subordinate Centrum Zdrowia Psychicznego w Drawsku Pomorskim
- Incident Type
- Ransomware attack that encrypted files on a computer containing an archival patient database.
- Incident Date
- 2023-03-03
- Disclosure Date
- 2026-05-05
- Data Types Exposed
- Identity data, including names, PESEL numbers, identity-document details, dates of birth, and citizenship; listed as affected or at risk, but exfiltration was not confirmed.
- Residential, registered, and correspondence addresses; listed as affected or at risk, but exfiltration was not confirmed.
- Telephone numbers and email addresses; listed as affected or at risk, but exfiltration was not confirmed.
- Health data, including medical records; listed as affected or at risk, but exfiltration was not confirmed.
- Limited information about arrest or detention where the individuals received healthcare; listed as potentially affected, but exfiltration was not confirmed.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Archival personal data became unavailable after files were encrypted. The infected server was taken out of service. The hospital reported checking other computers and finding no similar infections. Investigators found no evidence that personal data had been taken outside the hospital network, although the notice described theft as a high-probability concern that could not be confirmed or ruled out.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed