Skip to content
Today
Sections

Security Reports disagree3 publishers 2 min read Published

SQL injection in Qbusoft's Medyc software exposed Polish patients' PESEL numbers

Qbusoft confirmed an attacker stole patient data from its Medyc clinic software through an SQL injection flaw that went unnoticed for about 17 days. It is the second Polish clinic-software supplier to lose ID numbers in weeks, after MyDr lost data on nearly 19 million people in August.

The Watch · Security desk

Send a correction

Illustration accompanying SQL injection in Qbusoft's Medyc software exposed Polish patients' PESEL numbers
Generated illustration

What happened

  • Medyc's export commands had no time limit, so the attacker took every patient treated at an Inowrocław addiction day unit from July 1, 2024 to August 23, 2026.
  • Qbusoft confirmed that names, PESEL numbers, home addresses, phone numbers and email addresses were stolen, and has not said how many people were affected.
  • Digital Affairs Minister Krzysztof Gawkowski wrote on X that Qbusoft had not notified CERT Polska or CSIRT CeZ, the e-Health Center's incident response team.
  • Data protection chief Mirosław Wróblewski ordered an audit of the company, citing media reports that medical data on up to five million people may be involved.

Why it matters

  • Who's exposed exposure Whoever holds the archive can approach addiction and psychiatric patients with their own treatment history in hand, and the clinic has warned patients about fake therapy offers built on exactly that.
  • What doesn't add up contradiction A Medyc clinic that scopes its patient notices from Qbusoft's public statement alone would leave out the discharge summaries the vendor privately called highly likely stolen.
  • What it limits constraint Medyc clinics cannot count encryption at rest as a mitigation when deciding what to tell patients, because the vendor's own guidance is to treat names and PESEL numbers as plaintext.
  • What it sets up precedent Gawkowski's threat of the "strictest consequences" puts the choice of reporting channel on the enforcement table for Polish health-software vendors, alongside the breach itself.

According to a notice from the Odwykowo-Psychiatryczny Ośrodek Leczniczy in Inowrocław, Qbusoft's forensic findings trace the entry to an SQL injection flaw in Medyc's application interface [5]. It was exploited on August 22-23, 2026 [5]. The attacker packed the database into an encrypted archive and moved it off the vendor's systems [6]. Names and PESEL numbers were stored encrypted [9]. The vendor still told the clinic that, because of how the code was built, it should assume the data was easy to decrypt and that the attacker had it in plain text [9].

On medical records, the clinic's account goes further than the vendor's. The attacker ran scripts against tables holding medical data, and Qbusoft told the clinic it is highly likely that hospital discharge summaries were taken [22]. The clinic notified its patients on September 24 [17]. Qbusoft's own statement, posted on the Medyc website on September 25, said: "At this stage, the theft of medical documentation has not been confirmed" [2][21].

Detection came on the night of September 8 to 9 [6]. Counted from the August 22-23 exploitation, that is 16 to 18 days before anyone noticed [19]. Qbusoft says it removed the flaw the same day it found the attack, restricted database permissions, forced a rotation of all passwords and technical secrets, and put its infrastructure under constant monitoring [11]. The clinic's patients heard 15 days after detection [20]. Its systems have taken repeated attack attempts over the past week, the company says, and some modules may be limited or unavailable [4].

Qbusoft lists five bodies it did notify: the Central Cybercrime Bureau (CBZC), the data protection office UODO, CSIRT NASK, the e-Health Center and the Social Insurance Institution, ZUS [15]. Gawkowski's complaint is about the two incident-response teams missing from that list [13]. "In the event of a breach of any security procedure by a private company, the strictest consequences will be enforced," he wrote [14].

MyDr, the August victim, is a Warsaw company whose software is used by about 12,000 healthcare facilities. Its leaked database held PESEL numbers, contact details, visit records, prescriptions and treatment history [10]. The published record does not say how MyDr was breached or whether one actor hit both vendors [10]. On what is public, the link between the two incidents is the kind of supplier and the kind of data: clinic-software vendors holding national ID numbers next to treatment records [1][10]. Gawkowski wrote that the CBZC is looking into the Qbusoft incident as part of a broader investigation [12].

What to watch

  • A count of affected people from Qbusoft or from UODO's audit, set against the media reports of up to five million.
  • Whether the CBZC's broader investigation attributes the Medyc and MyDr thefts to one actor or one method.
  • Whether Qbusoft publicly confirms the discharge-summary theft, or other Medyc clinics issue notices matching the Inowrocław one.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence68
Adoption
Not scored
Hype gap+5
Incentives55
Confidence72

Perspective Coverage

3 publishers
Builder
Builder 28%
Operator
Operator 54%
Investor
Investor 18%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Hackers stole patient data from Qbusoft, a Polish medical software maker; the data comes from Medyc, a platform the company sells to medical offices and clinics to manage patient registration, records and prescriptions.

    Reported SupportedView cited source
  2. [2]

    Qbusoft published a statement on the Medyc website on September 25 confirming that attackers gained unauthorized access to personal data stored on Medyc's infrastructure and stole it.

    Reported SupportedView cited source
  3. [3]

    The confirmed stolen data includes names, PESEL numbers, home addresses, phone numbers and email addresses.

    Reported SupportedView cited source
  4. [4]

    Qbusoft said its systems have been hit by repeated attack attempts over the past week and that the service may run slower and access to some modules may be temporarily limited or unavailable.

    Reported SupportedView cited source
  5. [5]

    According to the clinic, findings made by Qbusoft with forensic experts show that on August 22-23, 2026, an unauthorized person exploited an SQL injection vulnerability in the application interface.

    Reported Supported Source: Inowroclaw clinic notice citing Qbusoft forensic findingsView cited source
  6. [6]

    The attacker used the flaw to move an encrypted archive of the database outside the vendor's systems. The attack was detected on the night of September 8 to 9.

    Reported Supported Source: Inowroclaw clinic noticeView cited source
  7. [7]

    Miroslaw Wroblewski, president of Poland's data protection authority UODO, ordered an audit of the company behind Medyc, citing media reports that the leak may involve the medical data of up to five million people.

    Reported Supported Source: UODO president Miroslaw Wroblewski, citing media reportsView cited source
  8. [8]

    The data export commands had no time limit; according to the clinic, the attacker took the personal data of every patient treated at its addiction day unit between July 1, 2024 and August 23, 2026.

    Reported Supported Source: Inowroclaw clinic noticeView cited source
  9. [9]

    The database stored names and PESEL numbers in encrypted form, but because of how the code was built, the vendor instructed the clinic to assume the data was easy to decrypt and that the attackers gained access to it in plain text.

    Reported Supported Source: Inowroclaw clinic noticeView cited source
  10. [10]

    In August, attackers stole data on nearly 19 million people from MyDr, a Warsaw-based company whose software is used by about 12,000 healthcare facilities. The leaked database held PESEL numbers, contact details, and information about patients' visits, prescriptions and treatment history.

    Reported SupportedView cited source
  11. [11]

    Qbusoft removed the vulnerability the same day it discovered the attack, restricted database permissions, forced a rotation of all passwords and technical secrets, and placed its infrastructure under constant monitoring.

    Reported SupportedView cited source
  12. [12]

    Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski announced on X that the CBZC is looking into the incident as part of a broader investigation.

    Reported Supported Source: Krzysztof Gawkowski, post on XView cited source
  13. [13]

    Gawkowski wrote that Qbusoft had not notified CERT Polska or CSIRT CeZ, the incident response team of Poland's e-Health Center.

    Reported Supported Source: Krzysztof Gawkowski, post on XView cited source
  14. [14]

    "In the event of a breach of any security procedure by a private company, the strictest consequences will be enforced," Gawkowski wrote.

    Reported Supported Source: Krzysztof Gawkowski, post on XView cited source
  15. [15]

    Qbusoft recorded "dangerous attacks" on its infrastructure on September 9 and reported the incidents to the Central Cybercrime Bureau (CBZC), the Personal Data Protection Office (UODO), CSIRT NASK, the e-Health Center and the Social Insurance Institution (ZUS).

    Reported SupportedView cited source
  16. [16]

    Qbusoft hasn't shared details on how many people were affected.

    Reported SupportedView cited source
  17. [17]

    The Odwykowo-Psychiatryczny Osrodek Leczniczy, an addiction and psychiatric treatment center in Inowroclaw that uses Medyc, notified its patients on September 24, a day before the vendor's statement.

    Reported SupportedView cited source
  18. [18]

    The clinic warned that scammers could contact patients, cite their treatment history and offer fake medical or therapy services.

    Reported Supported Source: Inowroclaw clinic noticeView cited source
  19. [19]

    Between 16 and 18 days, about 17, passed between exploitation of the Medyc SQL injection flaw and detection of the attack.

    Derived Supported
  20. [20]

    The Inowroclaw clinic notified patients 15 days after the attack was detected.

    Derived Supported
  21. [21]

    "At this stage, the theft of medical documentation has not been confirmed," Qbusoft wrote.

    Reported Contested Source: Qbusoft statement on Medyc websiteView cited source
  22. [22]

    The attacker ran scripts against database tables holding medical data; the vendor told the clinic it is highly likely the attackers obtained medical records in the form of hospital discharge summaries.

    Reported Contested Source: Inowroclaw clinic noticeView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. helpnetsecurity.com

    1 article · September 29, 2026

    Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider
  2. thecyberexpress.com

    1 article · September 29, 2026

    Polish Medical Software Hit by Cyberattack, Patient Data Stolen
  3. therecord.media

    1 article · September 28, 2026

    Cyberattack on Polish medical software provider exposes patient data

Topics and entities

Topics

Entities

  • Central Cybercrime Bureau (CBZC)
  • CERT Polska
  • Krzysztof Gawkowski
  • Odwykowo-Psychiatryczny Ośrodek Leczniczy
  • Mirosław Wróblewski
  • Personal Data Protection Office (UODO)
  • Zaufana Trzecia Strona