Data Theft from MyDr Database Affects 19 Million Poles

A massive data breach originating from the MyDr platform has potentially compromised the personal information of up to 19 million individuals in Poland, affecting approximately half the country's population. The stolen data originates from an estimated 10,000 to 12,000 clinics that utilize the MyDr system. While the full extent of the breach is still being assessed, the compromised data includes sensitive medical records, amplifying concerns for both individuals and the businesses that handle such information.

Mateusz Jankowski, a lawyer at Osborne Clarke, described the incident as one of the largest data leaks in Poland's history, particularly alarming due to the nature of medical data. He noted that such sensitive information can even be weaponized for political purposes, recalling an instance where a minister publicly revealed a doctor's prescription for psychotropic drugs. This breach follows a similar incident in 2023 where hackers stole data from over 50,000 individuals from the ALAB medical laboratories network.

Jankowski expressed concern that the short three-year interval between these major leaks indicates a failure to learn from past events. He stated that a repeat of such a large-scale breach so soon suggests that adequate lessons have not been absorbed. The MyDr platform is part of the DocPlanner group, which also operates the popular service Znany Lekarz. In 2023, DocPlanner reported collaborating with 47,000 doctors and serving 10-12,000 clinics, both commercial and those funded by the National Health Fund (NFZ).

The incident highlights the substantial losses data leaks can inflict on businesses. Jankowski outlined three primary risks for companies using such platforms: legal repercussions, reputational damage, and organizational disruption. While legal penalties might be the least concerning, the reputational damage is already significant, and many businesses historically neglected to prioritize data security when building systems. This large-scale breach serves as a stark example of the vulnerabilities and potential consequences.

“

Musimy tu mówić właśnie o dwóch płaszczyznach. Przede wszystkim to jest płaszczyzna przedsiębiorcy i przedsiębiorców, którzy korzystali z tego rozwiązania MyDr, czyli de facto zewnętrznego dostawcy IT. Możemy mówić o trzech ryzykach. Pierwsze, moim zdaniem, to jest najmniejsze zmartwienie tych przedsiębiorców, czyli ryzyko prawne, potencjalne kary administracyjne. Moim zdaniem ryzyko prawne nie jest wcale najpoważniejsze, bo możemy mówić jeszcze co najmniej o dwóch: ryzyku wizerunkowym i organizacyjnym.