SQL Injection Attack Exposes Patient Data in Polish Healthcare Sector

• •SQL injection vulnerability exploited to access patient data.
• •Personal data of patients from Inowrocław clinic compromised.
• •Repeated attacks on Qbusoft's infrastructure reported.

Hackers exploited an SQL injection vulnerability in Qbusoft's Medyc platform, compromising personal data of patients at the Addiction and Psychiatric Treatment Center in Inowrocław. The breach occurred between August 22-23, 2026, and was detected on September 9. Stolen data includes names, PESEL numbers, addresses, phone numbers, and email addresses, with a high likelihood that some medical records were also accessed. Qbusoft confirmed the incident on September 25, 2026, and reported it to relevant authorities. The company has faced repeated attack attempts and has implemented security measures to mitigate further risks. The incident follows a previous breach at another provider, MyDr, which exposed records of nearly 19 million individuals. Investigation into the breach is ongoing, and the company has not disclosed the total number of affected individuals.