Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider

Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider Hackers stole patient data from Qbusoft, a Polish medical software maker, weeks after a breach at another provider exposed records of nearly 19 million people in the country. The data comes from Medyc, a platform the company sells to medical offices and clinics to manage patient registration, records and prescriptions. In August, attackers stole data on nearly 19 million people from MyDr, a Warsaw-based company whose software is used by about 12,000 healthcare facilities. The leaked database held PESEL numbers (the Polish national ID number), contact details, and information about patients’ visits, prescriptions and treatment history. Qbusoft confirms the theft The company published a statement about the incident on the Medyc website on September 25, confirming that attackers gained unauthorized access to personal data stored on Medyc’s infrastructure and stole it. The confirmed stolen data includes names, PESEL numbers, home addresses, phone numbers and email addresses. “At this stage, the theft of medical documentation has not been confirmed,” the company wrote. It recorded “dangerous attacks” on its infrastructure on September 9, and has since reported the incidents to the Central Cybercrime Bureau (CBZC), the Personal Data Protection Office (UODO), CSIRT NASK, the e-Health Center and the Social Insurance Institution (ZUS). The company added that its systems have been hit by repeated attack attempts over the past week. “Due to the intensity and frequency of the attacks, the service may periodically run slower, and access to some modules may be temporarily limited or unavailable,” the statement reads. Qbusoft hasn’t shared details on how many people were affected. What the clinic’s notice says More details come from the Odwykowo-Psychiatryczny Ośrodek Leczniczy, an addiction and psychiatric treatment center in Inowrocław that uses Medyc. The clinic notified its patients on September 24, a day before the vendor’s statement. “Findings made by Qbusoft with the support of forensic experts show that on August 22–23, 2026, an unauthorized person exploited a security flaw in the application interface (an SQL injection vulnerability),” the clinic wrote. The attacker used the flaw to move an encrypted archive of the database outside the vendor’s systems. The attack was detected on the night of September 8 to 9. The data export commands had no time limit. According to the clinic, this means the attacker took the personal data of every patient treated at its addiction day unit between July 1, 2024 and August 23, 2026. The database stored names and PESEL numbers in encrypted form. However, the clinic’s notice states that, because of how the code was built, the vendor instructed it to assume the data was easy to decrypt and that the attackers gained access to it in plain text. The attacker also ran scripts against database tables holding medical data. The vendor told the clinic it is highly likely the attackers obtained medical records in the form of hospital discharge summaries. The clinic warned patients that information about their health and therapy could be used against them, “including in ways that lead to violations of personal rights and privacy, or to worse treatment in their place of residence and work.” Scammers, the clinic noted, could contact patients, cite their treatment history and offer fake medical or therapy services. Qbusoft removed the vulnerability the same day it discovered the attack. The company restricted database permissions, forced a rotation of all passwords and technical secrets, and placed its infrastructure under constant monitoring. Dispute over reporting In a post on his X account, Poland’s Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski announced that the CBZC is looking into the incident as part of a broader investigation. Although Qbusoft says it reported the incident to the authorities, Gawkowski wrote in the same post that the company had not notified CERT Polska or CSIRT CeZ, the incident response team of Poland’s e-Health Center. “In the event of a breach of any security procedure by a private company, the strictest consequences will be enforced,” he warned. Mirosław Wróblewski, president of Poland’s data protection authority (UODO), has ordered an audit of the company behind Medyc, citing media reports that the leak may involve the medical data of up to five million people in Poland.