MyDr CEO Apologizes After Data Breach Affecting Millions

MyDr CEO Piotr Miluski has apologized to patients and users following a major cyberattack, as investigations continue to determine the exact scope of the exposed medical data.

MyDr CEO Issues Public Apology

MyDr CEO Piotr Miluski apologized to all patients and users of the company in connection with a cyberattack. In a Monday statement, he announced that the company’s team is finalizing an analysis to determine which data was affected by the incident.

In August, the Ministry of Digital Affairs reported that a cyberattack on MyDr leaked the data of 19 million Poles, including information on medications and prescriptions. The company supplies electronic medical records systems, affecting 12,000 medical entities using the MyDr platform.

Miluski emphasized that his primary goal is to apologize for the anxiety, stress, and uncertainty caused by the situation, addressing every patient and user regardless of whether their data was directly impacted.

Scope of the Data Breach and Notifications

The investigation into the cyberattack by the Central Bureau for Combating Cybercrime (CBZC) is ongoing. Simultaneously, the MyDr team, working with external experts, is finalizing an analysis to precisely determine the scope of the incident.

The company announced that it will begin officially notifying medical facilities in the coming days in accordance with GDPR and will assist them in communicating with patients, adopting a deliberately broad approach at this stage.

Miluski noted that information could reach approximately 18 million individuals through medical facilities, as their data—primarily historical information from April 2024 or earlier—cannot be excluded from the incident’s scope at this analysis stage.

He stressed that this figure does not mean data for 18 million people was stolen, read, or published. MyDr teams and external experts are continuously monitoring the situation and have not detected any public disclosure of the affected data.

The CEO assured that the company will continue to cooperate with the relevant authorities and provide them with all necessary information.

Investigation and Official Responses

The investigation by the Central Bureau for Combating Cybercrime into the MyDr data leak is supervised by the District Prosecutor’s Office in Warsaw. It concerns unauthorized access to MyDr’s IT system and server-stored information by an unidentified individual who bypassed security measures and leaked a data excerpt to the “Zaufana Trzecia Strona” service, carrying a penalty of up to three years in prison.

The Ministry of Health reported last week that the e-Health Centre is cooperating with services coordinating the incident response to limit potential effects, noting that central e-health services were not breached and patient access to healthcare services, prescriptions, and the public health system remains unaffected.

The ministry recommends applying basic cybersecurity rules regardless of the incident, including reserving the PESEL number via the mObywatel application, using strong and unique passwords, utilizing multi-factor authentication (MFA), and exercising caution with phishing emails, SMS messages, and phone calls.

Deputy Minister of Digital Affairs Dariusz Standerski announced legislative changes to tighten liability for entities processing medical data, with proposals expected to be shared this week.

The Personal Data Protection Office (UODO) has also announced an inspection of MyDr focusing on applied technical and organizational measures, including risk analysis.