In August 2026, media outlets reported a major data breach at mydr, a telemedicine service provider. As a result of the cyberattack, the PESEL numbers, medical records, and contact information of many patients may have fallen into the wrong hands. What steps should you take to minimize the risk of identity theft? We examine the procedures and expert recommendations.
What exactly was leaked from mydr systems?
According to official statements from mydr, the hack targeted a database containing patient information. Although the company emphasizes that no passwords or payment data were leaked, it has been confirmed that the following information was exposed:
- PESEL numbers – key identifiers that can be used for fraud attempts;
- Medical data – medical histories, prescriptions, or test results;
- Contact details – home addresses, phone numbers, and email addresses;
- Insurance information – policy numbers (without associated bank details).
Cybersecurity experts point out that the attack likely exploited a vulnerability in the database software. However, it is not certain whether the attack was carried out by a specialized ransomware group or if the goal was simply to acquire the database for resale.
When did the attack occur and why was it reported so late?
The timeline of the incident has sparked significant debate. Several days passed between the attack itself and the official notification of the public, which drew criticism from the IT security industry. Any such delay, regardless of procedural or PR reasons, means additional time during which victims are unknowingly exposed to risk.
The Personal Data Protection Office (UODO) and relevant law enforcement agencies quickly took up the case and are investigating the security procedures implemented at the company. This is another case demonstrating how crucial immediate response to security incidents is – especially when sensitive medical data is involved.
What are the real consequences of the breach for the victims?
Although little time has passed since the breach was disclosed, specialists are already warning about the first attempts to use the stolen data. In similar situations, one should generally expect threats such as:
- Loan fraud attempts – scammers may try to submit credit applications using stolen personal data;
- Medical fraud – attempts to illegally obtain prescriptions or services under someone else's name;
- Phishing and social engineering attacks – fake emails and SMS messages impersonating mydr, clinics, or financial institutions to steal further data.
At this moment, there are no reports of mass theft of funds from bank accounts, but experts remind us that stolen data can circulate on the web for years. It could be used much later, for example, to set up fictitious business entities.
How to reserve your PESEL and is it enough?
Reserving your PESEL number is a fundamental step that should be taken as soon as possible. The procedure is free and can be done easily online:
- Go to obywatel.gov.pl and select the "Zastrzeż PESEL" option;
- Log in using your Trusted Profile (profil zaufany), e-ID, or electronic banking;
- Confirm the operation – the status in the system will change immediately.
Reserving your number blocks the ability to take out loans or sign certain contracts using your PESEL, but it does not protect against all threats. Scammers may still try to use medical or contact data. Therefore, it is worth implementing additional protection measures:
- Activate BIK alerts – this service allows you to receive real-time notifications about attempts to take out obligations using your data (BIK.pl);
- Change passwords – do this for patient accounts, email inboxes, and other services, especially if you used the same login credentials as you did at mydr;
- Stay vigilant with messages – do not click on links in messages about alleged "data verification" following the breach.
What actions have the authorities taken?
The response from state institutions has been multi-faceted:
- UODO has launched an inspection at mydr, which may result in the imposition of heavy administrative financial penalties;
- The Ministry of Digital Affairs reminded the public of government identity protection tools and appealed for the preventive reservation of PESEL numbers;
- CERT Polska has provided dedicated tools and communications to help verify the security of your data (sprawdzpesel.cert.pl).
It is worth following the official communications of these institutions, as recommendations may be updated as the situation develops and the investigation progresses.
Will mydr face consequences?
The consequences for the company could prove severe on several levels:
- Legal – the investigation will determine whether security measures were adequate to the threats and whether there was any negligence;
- Financial – the company's stock prices saw significant drops after the attack was disclosed, and some clients are already declaring they will stop using the services;
- Reputational – rebuilding patient trust in the telemedicine platform is a long-term and extremely difficult process.
This is another warning to the market that cutting costs on IT security infrastructure and audits can lead to massive losses in the future.
How else to protect your identity in 2026?
Reserving your PESEL is the starting point. Security specialists recommend adopting good habits:
- Qualified signature – consider using a secure electronic signature for official and business matters, offered by, among others, Poczta Polska;
- Two-factor authentication (2FA) – enable it wherever possible, especially in banking, email, and medical portals;
- Protection against phishing – use solutions that warn against suspicious websites, such as those developed by cert.pl/phishing-alert;
- Credit reservation at BIK – consider using system blocks to prevent financial institutions from accessing your credit report;
- Daily awareness – do not provide personal data over the phone when a "consultant" calls, and carefully check the addresses of the websites where you log in.
Summary: What to do now?
If you have used mydr services, do not panic, but take concrete actions:
- Check the status of your data – use official verification tools (sprawdzpesel.cert.pl);
- Reserve your PESEL – do it immediately via the obywatel.gov.pl portal;
- Secure your accounts – change passwords and enable two-factor authentication;
- Monitor the situation – consider activating notifications for credit inquiries (BIK.pl).
A data breach is a serious problem, but quick and organized action allows you to effectively neutralize most threats associated with identity theft.
If you want to learn more about online security, read our articles on end-to-end encryption vulnerabilities and attacks on AI systems.
Sources
- https://www.polsatnews.pl/wiadomosc/2026-08-13/twoj-pesel-mogl-trafic-w-niepowolane-rece-tak-mozesz-go-zastrzec/
- https://www.tvn24.pl
- https://www.onet.pl
- https://www.my-dr.pl/incydent
- https://www.gazetaprawna.pl
- https://www.cert.pl
- https://www.pb.pl
- https://www.rp.pl
- https://uodo.gov.pl/pl/138/2804
- https://www.policja.pl/pol/aktualnosci/247330,Wzrost-oszustw-zwiazanych-z-wyciekiem-danych-z-MyDr.html
- https://wyborcza.pl
- https://www.gov.pl/web/cyfryzacja
- https://sprawdzpesel.cert.pl
Comments