Polish authorities are investigating a cyberattack against the healthcare software provider MyDr, which may have exposed data belonging to approximately 19 million individuals and over 12,000 medical facilities. MyDr, a private Polish company that supplies software to various healthcare providers, confirmed on Friday that it had identified and remediated the cause of the incident and implemented additional security measures. The company did not specify the vulnerability exploited or the method of attacker access.
MyDr initially disclosed last week that parts of its systems had been affected by what it described as external, intentional criminal activity. Polish authorities have indicated that unauthorized access was gained to historical data within MyDr systems, dating up to April 2024. However, they noted that the breach might not encompass all MyDr customers or their patients. MyDr has stated that it has found no evidence to date that the compromised data has been published or made publicly available.
MyDr's software facilitates connections between healthcare providers and P1, Poland's national electronic health platform, which supports services such as electronic prescriptions and referrals. The company also develops tools for managing medical practices and electronic medical records.
As a precautionary measure, Poland's Digital Affairs Minister Krzysztof Gawkowski announced on Friday that the country's e-Health Center is replacing digital certificates used by medical systems to connect to P1. Gawkowski clarified that authorities have found no evidence of these certificates being stolen or misused in the MyDr attack, emphasizing that the replacement is intended to prevent potential future unauthorized access. Officials anticipate that this measure will not disrupt patient services, including electronic prescriptions and referrals. Health Minister Jolanta Sobierańska-Grenda affirmed on Monday that the incident poses no threat to Poland's public healthcare systems and that P1 remains secure. MyDr has also confirmed that its systems are operational and secure for both doctors and patients.
Poland's Personal Data Protection Office plans to conduct an inspection of MyDr, while security agencies are working to identify those responsible for the attack. Gawkowski stated last week that if the investigation reveals that MyDr failed to adhere to proper procedures or adequately protect its systems, the company will face legal repercussions.
The attack has not been attributed to any specific threat actor. Earlier this month, the Polish cybersecurity publication Zaufana Trzecia Strona reported that individuals claiming responsibility for the intrusion had contacted them, providing what they asserted was evidence of the breach. This evidence reportedly included a screenshot containing information related to a prominent Polish politician. Claims and samples reported by Polish cybersecurity media suggest that the stolen material could include names, dates of birth, identification numbers, certain prescription details, and other medical records. These claims have not been independently verified.
This incident follows another recent cyberattack disclosure by a major Polish company. The convenience store chain Żabka reported earlier this month that attackers gained access to its internal company systems via an account belonging to a third-party contractor. Żabka stated that its transactional systems, consumer services, mobile application data, and business operations were unaffected. It is currently unclear whether the two incidents are connected.
