Desk live·
ForensicPost
Breaches/Healthcare/File 26-0813

19 Million Medical Records Stolen in Polish MyDr Hack

Prescriptions, appointments and medication histories for around 19 million people were taken from MyDr, a platform used by more than 12,000 Polish medical facilities. Poland’s digital affairs minister says there is no indication of an external attack.

Constructed geometry · not a chart of case data
JurisdictionPolandWarsawthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetMyDr
ActorUnattributed
S. Rosler11 min readConfidence: medium3 sources reviewed

Polish authorities are investigating the loss of data from MyDr, a healthcare software platform used for appointments, medical records and prescriptions. Reporting puts the exposure at close to 19 million people and more than 12,000 medical facilities, and the volume at over 2.5 terabytes. The data is described as including prescriptions, appointment schedules, medication records and documents uploaded by patients.

Krzysztof Gawkowski, Poland’s minister of digital affairs, announced the incident on 12 August 2026. Whoever holds the data demonstrated it by publishing a senior politician’s PESEL number, telephone numbers and 25 prescriptions. Gawkowski said there is no indication of an external attack from Russia or any other country, and officials have raised human error, system failure, sabotage and negligence by the operating company as possibilities.

The Data Is Out And The State Will Not Call It An Attack

Both statements can hold. A misconfigured store, an exposed interface, or a copy taken by someone with legitimate access produces the same result as an intrusion and leaves almost none of the same evidence.

We do not know which happened, and on the public record neither does the Polish government. That is why this file names no actor and is graded medium. It also puts the case in the same category as the Advocate Aurora tracking-pixel disclosure and Toyota’s decade-long cloud exposure: serious harm with no attacker in it.

A Prescription List Is A Diagnosis

Twenty-five prescriptions were published to prove possession. A prescription history is not contact data. Read in sequence it shows what someone is being treated for, how that has changed and how serious it is.

Psychiatric medication, antiretrovirals and fertility treatment sit in the same table as antibiotics. The regimes that govern this data count records, and a record count cannot distinguish between them.

PESEL Cannot Be Reissued

The Polish national identification number encodes date of birth and sex in its structure and is used across health, tax and administrative systems. It is not replaceable in any practical sense.

France Travail lost 43 million French national insurance numbers in 2024, which carry the same problem. Nineteen million is close to half of Poland’s population, and the identifier at the centre of it is one nobody can be issued a new one of.

12,000 Clinics Chose This, And The Patients Did Not

The affected people did not select MyDr. Their clinic did, and most will not have heard the name before this week.

Supplier concentration is the most common structure in this database, but the ratio here is unusual: one company, twelve thousand institutions, close to half a national population, and no point at which any of those patients could have chosen otherwise.

How we reported this

Compiled from Polish government statements and public reporting, listed below. Figures come from officials describing an investigation in progress and from the party publishing the data; we treat them as reported rather than established. No cause has been determined and we are not speculating on one. The politician is not named and we have not accessed any published material. Corrections: corrections@forensicpost.com.

Sources
  1. Poland probes MyDr healthcare software breach potentially affecting 19 million peopleThe Record
  2. Poland hit by theft of 19 million patients’ data from medical platformNotes From Poland
  3. Medical data of 19 million Poles stolen in major breach, minister saysPolska Agencja Prasowa
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary