Breaches and incidents
Medyc (Poland): medical software vendor confirms theft of patient personal data including PESEL
Medyc’s notice says that “in connection with a cyberattack on Medyc’s infrastructure” personal data was accessed and stolen.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Medyc’s notice says that “in connection with a cyberattack on Medyc’s infrastructure” personal data was accessed and stolen; confirmed stolen data includes names, PESEL numbers, home addresses, phone numbers and email addresses, while theft of medical records “has not been confirmed.”
- Root cause: not disclosed; the notice describes attacks beginning 9 Sep 2026 and frequent repeated attempts that may slow the service.
- No attacker named.
- Medyc says it reported to UODO and police on 9 Sep 2026 and informed CBZC, CSIRT NASK, Centrum e-Zdrowia and ZUS; the notice was last updated 28 Sep 2026 and its first public posting date is not shown.