Medical data breaches. What should you do and check?

On 12 August 2026, Poland’s Ministry of Digital Affairs reported unauthorised access to historical information in the systems of medical software supplier MyDr. Its notice stated that the incident could affect 18.8 million people and more than 12,000 healthcare providers. This is a potential scale, not an identical set of exposed data for every individual.

The Warsaw District Prosecutor’s Office listed identification and contact details as well as information about health, appointments and prescriptions in its 13 August statement. On 12 August, the Ministry of Health stated that central e-health services had not been breached. Individual impact needs confirmation from the relevant data controller.

This article uses official notices checked on 11 September 2026. Their August publication dates matter: a later patient notification does not by itself indicate a new attack.

A breach at a separate provider does not establish that somebody signed in to your email or accessed your phone. Those are separate questions. An assessment should consider the notice and any unfamiliar sign-ins or changes on your accounts.

Exposed information can nevertheless help someone convincingly impersonate a clinic, bank or other institution. A caller knowing real details about you does not establish their identity.

Read the clinic’s official notice. Contact it through a known channel found independently, rather than a link or number supplied in an unexpected message.

Where your Polish PESEL identification number is involved, use the official restriction service, for example through mObywatel. Specified organisations check the register before certain activities.

Restriction does not erase information already obtained by an unauthorised person or replace account security. Treat it as part of the response rather than the end of the matter.

Where a password was exposed, change it in that service and wherever it was reused. Use distinct passwords and additional sign-in verification for important accounts. Exposure of medical information alone does not prove that your email password leaked.

During the review I also examine less visible settings: recovery methods, active sessions, app permissions and document sharing. A password change is one possible action, not a replacement for assessing the situation.

The Executive Digital Risk Review starts with your situation: what happened, which information concerns you and which accounts and devices you use. I assess the agreed scope and explain the findings in plain language.

I consider basic protection alongside details that are easy to overlook: email access, account recovery, preparation for a lost phone and file-sharing arrangements. You receive a report and priorities for seven and 30 days.

The review costs PLN 6,900 including VAT for private clients. Implementation has a separately agreed scope, responsibility and price. I handle the work personally; tasks requiring a different specialism have an agreed provider.

The aim is to reduce risk on your side and prepare a proportionate response. A review does not give control over a separate clinic’s systems or guarantee removal of stolen data. Reviewing a doctor’s or clinic owner’s personal accounts also differs from auditing the whole practice.

Explain what concerns you and whether you have received an official notice. Leave passwords, codes, PESEL numbers and medical records out of the first message. We agree how to share any necessary information before work begins.

Initial qualification is free. I will explain whether a review, a shorter consultation or urgent contact with another organisation is appropriate. Paid work begins only after scope, timing and price are confirmed.