Polish authorities are investigating a cyberattack against MyDr, a healthcare software provider that connects more than 12,000 medical facilities to Poland’s national electronic health platform, known as P1. The company disclosed the incident last week, describing it as “external, intentional criminal activity.” Polish officials have not attributed the attack to a specific threat actor, but initial claims and samples circulated by Polish cybersecurity media suggest the stolen material could include names, dates of birth, national identification numbers, prescription information, and other medical records belonging to up to 19 million people.
Poland’s minister of digital affairs confirmed that digital certificates used by healthcare providers to access P1 have been suspended as a precautionary measure, and that their replacement should not disrupt patient services such as electronic prescriptions and referrals. MyDr says its systems remain operational and safe for use by doctors and patients. If the investigation finds the company failed to meet security requirements, it will face legal consequences under Polish law, an official said. A separate recent cyberattack on Polish grocery chain Żabka may be unrelated, but authorities have not ruled out a connection.