SQL Injection Attack Exposes Patient Data from Polish Medical Software Provider
Summary
Qbusoft confirmed patient data was stolen from its Medyc platform via SQL injection. Names, PESEL numbers and contact details were exposed; medical records may also have been accessed. Authorities are investigating, and the company says it patched the flaw.
Key points
- A clinic’s notice, citing Qbusoft’s forensic findings, says an attacker exploited an SQL injection flaw in Medyc’s application interface on August 22–23, 2026.
- The attacker exported an encrypted database archive; the clinic was told to assume names and PESEL numbers could be decrypted.
- Qbusoft confirmed theft of names, PESEL numbers, addresses, phone numbers and email addresses. Theft of medical documentation has not been confirmed, though the vendor reportedly considered access to discharge summaries highly likely.
- The clinic says the exported data covered every patient treated at its addiction day unit from July 1, 2024, to August 23, 2026; Qbusoft has not disclosed the total number affected.
- Qbusoft says it removed the vulnerability, restricted database permissions, rotated passwords and technical secrets, and placed its infrastructure under monitoring.
- Polish authorities are investigating. The data protection authority ordered an audit, while the deputy prime minister said the company had not notified CERT Polska or CSIRT CeZ, contrary to Qbusoft’s reported notification claims.
Article Details
- Victim Organization
- Qbusoft
- Incident Type
- Data theft following exploitation of an SQL injection vulnerability in the Medyc application interface
- Incident Date
- 2026-08-22
- Disclosure Date
- 2026-09-24
- Data Types Exposed
- Names
- PESEL numbers
- Home addresses
- Phone numbers
- Email addresses
- Medical records, including hospital discharge summaries (highly likely accessed, but not confirmed)
- Affected Records
- Not disclosed; the clinic said the stolen data covered every patient treated at its addiction day unit from 2024-07-01 through 2026-08-23. A separate report cited a possible exposure involving up to five million people, but this was not established as the number affected by this incident.
- Operational Impact
- Qbusoft said the service might run slower and some modules might be temporarily limited or unavailable because of repeated attacks. The company removed the vulnerability, restricted database permissions, rotated passwords and technical secrets, and placed its infrastructure under constant monitoring.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed