Data Breach Affects Millions of Polish Patients via Medyc Software

• •The breach may affect up to five million patients due to a SQL injection vulnerability.
• •Sensitive personal data, including PESEL numbers and health information, was compromised.
• •Authorities are investigating Qbusoft for failing to report the incident promptly.

A significant data breach has occurred involving the Medyc software, affecting potentially five million Polish patients. The Central Bureau of Combating Cybercrime is investigating the incident, which was linked to a SQL injection vulnerability exploited between August 22-23, 2026. The breach resulted in unauthorized access to sensitive personal data, including names, PESEL numbers, addresses, and contact information. The incident was detected on September 8-9, 2026, and has raised alarms about the security practices of the software provider, Qbusoft Sp. z o.o. Authorities are urging affected individuals to take precautions, such as monitoring their PESEL numbers to prevent identity theft. The breach follows a previous incident involving MyDr, which had already compromised the data of 19 million Poles. Current investigations are ongoing, and the UODO has announced plans for further audits of data processing practices in the healthcare sector.