MyDr Says Attacker Copied Patient Database; No Evidence of Public Release
Summary
MyDr says an attacker accessed its environment and copied a cloud database containing historical patient data. The company reports no evidence the data was publicly released and is notifying affected clinics.
Key points
- MyDr said its investigation confirmed that an unauthorized third party accessed its environment and copied a cloud database containing data stored before April 12, 2024.
- For a limited number of people, data in cancelled e-referrals issued after that date may also have been involved.
- Potentially affected data includes names, addresses, contact details, PESEL numbers, health and social-insurance information, and, where provided, employer details. The scope varies by patient and clinic.
- MyDr said its forensic investigation found the incident contained, with no evidence of further unauthorized access or public release of the data.
- The company said around 18 million people could not yet be excluded from the potential scope; it stressed this does not mean their data was stolen, read, or published.
- MyDr is notifying affected clinics in stages and providing tools and templates to help them notify patients and meet reporting obligations.
- MyDr and Poland’s CEZ recommended a coordinated, precautionary rotation of P1 certificates; the company said it had no indication those certificates were compromised or misused.
Article Details
- Victim Organization
- MyDr
- Victim Domain
- mydr.pl
- Incident Type
- Cyberattack resulting in unauthorized access to the MyDr environment and copying of a cloud-stored database.
- Disclosure Date
- 2026-08-12
- Data Types Exposed
- Names
- Residential addresses
- Contact details
- PESEL numbers
- Health data
- Social insurance data
- Employer information, if provided
- Other identifying information
- Personal data in canceled electronic referrals issued after 2024-04-12 for a limited number of people
- Affected Records
- Unknown. MyDr said approximately 18 million people were included in a precautionary notification scope, but emphasized this does not mean their data was stolen, read, or exposed. The exact number of people whose data was copied was not disclosed.
- Affected Data Size
- Unknown; the amount and types of data disclosed were not confirmed at the time of the update.
- Operational Impact
- MyDr said the incident was contained, the cause was identified and removed, and forensic analysis found no evidence of continued unauthorized access. MyDr reported that its systems remained operational. The database content copied was stored in MyDr's cloud environment and dated from before 2024-04-12; for a limited number of people, data in canceled electronic referrals issued after that date was also involved.
- Ransom Or Extortion
- Not disclosed.
- Claim Status
- confirmed