One of the largest medical data breaches in Poland’s history has potentially exposed the records of nearly 19 million citizens.
Almost half the country. The figure of 18.8 million represents the potential scale of the breach, not a confirmed count of victims. But even the possibility of a breach on this scale is extraordinary.
What makes this breach particularly unsettling is not just the number. It is the nature of the data. A stolen password can be changed. A medical record cannot. The combination of personal identifiers with specific medical information creates a vulnerability that cannot simply be eliminated by changing a password or closing an account. Who took what medication? Who was treated for what condition. Who visited which specialist? These are not abstract data points. They are concrete details about individual lives.
A credit card can be cancelled. Medical history does not work that way. A diagnosis, a prescription or a record of psychiatric treatment remains part of a person’s history regardless of whether the original database is secured tomorrow. The value of such information to criminals is therefore not limited to immediate fraud. It can be used for impersonation, extortion or harassment, while the mere knowledge that it exists outside the patient’s control creates a different kind of vulnerability.
The State and Its Private Infrastructure
The investigation so far indicates that an unauthorised party accessed the data over the internet, either by breaking or bypassing security measures, after which part of the information was made available to others. Gawkowski has stated that the breach was not a foreign state-backed attack and that the motive appears to have been financial. The investigation continues.
MyDr is a private software provider whose systems are used by thousands of medical facilities across Poland. It is not a state agency. The central e-health services were not compromised, and the incident did not affect the issuance of prescriptions or the functioning of public health services. But Poland’s healthcare system had nevertheless come to rely on a private provider through which thousands of clinics processed patient data.
The important point is that a digital state does not consist only of government websites and official apps. Much of the infrastructure behind it sits outside government itself: contractors, databases and platforms through which sensitive information is processed every day. To the citizen, the service may appear seamless. Behind it, however, is a chain of organisations, each with its own systems, security practices and points of failure. The longer that chain becomes, the harder it is for an ordinary citizen to know who ultimately bears responsibility for protecting the information being collected about them.
Modern public services increasingly depend on private infrastructure to process information essential to their functioning. That dependence is not necessarily a problem in itself, but it becomes one when oversight is insufficient and responsibility is unclear.
Ambition Without Resilience
Poland has spent years making public services increasingly digital, from its mObywatel government-services app and digital IDs to electronic prescriptions. The MyDr breach shows the less visible side of that transformation: the private infrastructure on which much of the digital state depends.
Digitization creates a vulnerability that paper-based systems rarely had: a failure can affect millions of people at once. The speed of digitization has not always been matched by the same attention to resilience and security. The more data is concentrated in systems that serve large numbers of institutions, the more valuable those systems become to whoever can access them. The more centralized the system, the greater the potential damage from a single breach. This is not an argument against digitization. It is an argument for treating resilience and security as part of digitization itself.
The Government’s Response
The government’s response has been revealing. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski presented the measure as a simple precaution. The advice is sensible. But it shifts some of the burden of the breach onto citizens themselves. The state that has encouraged citizens to move more and more of their interactions with public services into digital systems now tells them to protect themselves.
Locking a PESEL can reduce the risk of certain forms of fraud. It cannot make the underlying medical information private again. Nor can it tell citizens whether their diagnoses, prescriptions or treatment histories have already been copied, stored or redistributed. The measure protects against some consequences of the breach. It does not undo the breach itself.
A Wider Pattern
Britain provides a useful comparison. The Synnovis cyberattack in June 2024, which affected NHS services and led to significant data theft, demonstrated the vulnerability of healthcare systems that rely on external contractors and private infrastructure. The analysis of the full scope of that breach took over a year. It has also become part of a broader British debate over the role of external contractors in accessing patient data through the Federated Data Platform.
Similar incidents across European healthcare systems show that rapid digitization without parallel investment in security and institutional oversight creates systemic risks. The larger the scale of data centralization and the greater the role of private providers, the more severe the consequences of a single failure can become.
The Cost of Digital Dependence
Medical privacy is not merely about identity theft. It is about information that can permanently alter how employers, insurers, acquaintances or institutions perceive someone. A history of psychiatric treatment. A diagnosis that carries stigma. Medication for a condition someone would rather keep private. Once that information is exposed, it cannot be recalled. The consequences are not abstract. They are felt in the details of people’s lives.
Poland has been building a digital state for years. It has done many things right. But it has also built a system whose vulnerabilities are now becoming visible. The breach of nearly 19 million medical records is not just a security incident. It is a test of whether the state can protect what it knows about its citizens.
The MyDr breach did not compromise Poland’s digital state by taking down government systems. It exposed a more complicated weakness: critical public functions increasingly depend on private digital infrastructure whose failure can have consequences far beyond the company that operates it. When that infrastructure fails, the state can advise citizens to protect themselves, but it cannot undo the damage. That is the cost of digital dependence.
Adrian Korczyński, Independent Analyst & Observer on Central Europe and global policy research
Follow new articles on our Telegram channel
