Polish authorities are investigating the loss of data from MyDr, a healthcare software platform used for appointments, medical records and prescriptions. Reporting puts the exposure at close to 19 million people and more than 12,000 medical facilities, and the volume at over 2.5 terabytes. The data is described as including prescriptions, appointment schedules, medication records and documents uploaded by patients.
Krzysztof Gawkowski, Poland’s minister of digital affairs, announced the incident on 12 August 2026. Whoever holds the data demonstrated it by publishing a senior politician’s PESEL number, telephone numbers and 25 prescriptions. Gawkowski said there is no indication of an external attack from Russia or any other country, and officials have raised human error, system failure, sabotage and negligence by the operating company as possibilities.
The Data Is Out And The State Will Not Call It An Attack
Both statements can hold. A misconfigured store, an exposed interface, or a copy taken by someone with legitimate access produces the same result as an intrusion and leaves almost none of the same evidence.
We do not know which happened, and on the public record neither does the Polish government. That is why this file names no actor and is graded medium. It also puts the case in the same category as the Advocate Aurora tracking-pixel disclosure and Toyota’s decade-long cloud exposure: serious harm with no attacker in it.
A Prescription List Is A Diagnosis
Twenty-five prescriptions were published to prove possession. A prescription history is not contact data. Read in sequence it shows what someone is being treated for, how that has changed and how serious it is.
Psychiatric medication, antiretrovirals and fertility treatment sit in the same table as antibiotics. The regimes that govern this data count records, and a record count cannot distinguish between them.
PESEL Cannot Be Reissued
The Polish national identification number encodes date of birth and sex in its structure and is used across health, tax and administrative systems. It is not replaceable in any practical sense.
France Travail lost 43 million French national insurance numbers in 2024, which carry the same problem. Nineteen million is close to half of Poland’s population, and the identifier at the centre of it is one nobody can be issued a new one of.
12,000 Clinics Chose This, And The Patients Did Not
The affected people did not select MyDr. Their clinic did, and most will not have heard the name before this week.
Supplier concentration is the most common structure in this database, but the ratio here is unusual: one company, twelve thousand institutions, close to half a national population, and no point at which any of those patients could have chosen otherwise.
Compiled from Polish government statements and public reporting, listed below. Figures come from officials describing an investigation in progress and from the party publishing the data; we treat them as reported rather than established. No cause has been determined and we are not speculating on one. The politician is not named and we have not accessed any published material. Corrections: corrections@forensicpost.com.