Major cyberattack on medical data service occurred in Poland
Poland is investigating a large-scale cyberattack on the MyDr medical platform. According to a preliminary estimate, the incident could potentially affect data of up to 18.8 million people. Polish authorities are currently determining what specific information was obtained by the attackers and whose data was affected.
Poland’s Ministry of Digital Affairs announced that after identifying the compromised data, information will be gradually added to the government service BezpieczneDane.gov.pl. The process may take several days due to the large volume of information.
At the same time, the figure of 18.8 million does not yet mean that a data leak involving exactly that number of people has been confirmed. It refers to the maximum possible number of users who could be affected by the incident. Specialists are establishing the actual scale.
MyDr works with patients’ medical records
MyDr is a system used by Polish healthcare institutions and doctors. It allows keeping electronic medical records, issuing electronic prescriptions and referrals, working with patient cards and storing documents, including test results. Therefore, the investigation of the attack is of particular importance due to the potentially sensitive nature of the processed information.
Authorities have not confirmed that the entire set of medical information processed through MyDr has fallen into the hands of the attackers. It should also not be assumed that each potentially affected user had the same set of data stolen.
Specialists need to determine not only the number of victims, but also the specific categories of data that may have been obtained during the attack. After that, the relevant information will be transferred to the government verification system.
How to check your data
The Polish service BezpieczneDane.gov.pl allows a person to check whether their personal data has been illegally published on the Internet as a result of a cyberattack or another security incident. The service is operated by Poland’s national computer incident response center CSIRT NASK.
In the case of MyDr, the authorities have warned that information will appear in the database gradually. Therefore, the absence of information immediately after the attack report does not necessarily mean that a particular person was not affected.
If a leak is confirmed, Polish services recommend paying special attention to the security of accounts, not using the same passwords across different services, and monitoring suspicious transactions on bank accounts and cards.
If personal data is compromised, it is also possible to reserve the PESEL number. Poland’s Ministry of Digital Affairs recommends keeping PESEL blocked when it is not needed for specific operations: this limits the ability to use stolen personal data, in particular for taking out a loan or credit.
The cyberattack investigation is ongoing. The final number of people whose data was actually compromised, as well as the full list of stolen information, has not been established yet.
Sources: Business Insider Polska, BezpieczneDane.gov.pl, MyDr
