Gawkowski confirms: another massive leak of Poles’ medical data. This time Med
Just a few weeks after the MyDr leak, hackers attacked more medical software. Data of up to a million patients could have been leaked, including PESEL numbers and medical records.
It is a program for operating offices and clinics called Medyc, created by the Olsztyn company Qbusoft. The attack took place on August 22-23, and the producer learned about it only on the night of September 8-9. The case came to light when the first facilities started notifying patients. One of them was the Addiction and Psychiatric Treatment Center in Inowrocław.
PESEL data, telephone numbers and e-mails are in the hands of criminals
The attackers exploited a SQL Injection vulnerability and copied the encrypted database archive. However, the encryption turned out to be weak. Names, surnames, PESEL numbers, addresses, telephone numbers and e-mail addresses could be found in the hands of criminals. Medical documentation, e.g. hospital discharge notes, could also have been leaked. The center in Inowrocław concerns patient data from July 1, 2024 to August 23, 2026.
The Zaufana Third Party website estimates that the leak may affect over a million patients from hundreds of facilities. The perpetrators claim to have data on 5 million people and 8 million medical photos. No one has confirmed this yet.
The same perpetrators as with MyDr
According to the Trusted Third Party, the same person or group that used the pseudonym “fingerprint” is behind the attack. It is responsible for the August leak from the MyDr system, which affected the data of approximately 19 million Poles.
The leak was confirmed by the Minister of Digitization, Krzysztof Gawkowski. The case was handled by the Central Office for Combating Cybercrime. Minister of Digitization Krzysztof Gawkowski announced that if a private company violated security procedures, “absolute consequences will be drawn.”
According to the ministry, Qbusoft did not report the incident to CERT Polska or the CSIRT e-Health Center team. The manufacturer announced that it has already removed the vulnerability, forced password changes and strengthened security.
Is there any way each of us can react to the leak from Medyc?
Experts advise to reserve your PESEL number. You should also be careful with calls, text messages and e-mails in which someone refers to treatment, prescriptions or “data verification”. The facility where the patient was treated should be informed about the leak.
Sources: CyberDefence24, Zaufana Trzecia Strona, GeekWeek, Forsal, MC
