The night receptionist and 13 million PESEL numbers. Two MyDr stories that are easy to confuse

It is night. The clinic closed hours ago, the lights at the front desk are off, the computers are asleep. And yet one of this clinic's accounts is busier than it has ever been: it is asking a state system whether the person with a given PESEL number — the Polish national identification number — has health insurance. It gets an answer: first name, surname, status. It asks about the next number. And the next. It takes no coffee breaks, never mistypes a digit, never goes home.

Nobody witnessed this scene, and we do not know at what hour or from how many accounts it really happened — investigators have not released those details. What we do know is the final tally: around 18 million queries and the data of more than 13 million people. This is the first of two stories in which the name MyDr appears. The second, far louder, took place two years later and concerns nearly 19 million people. For a few days in August 2026 the two merged into one — wrongly.

Act one: spring 2024. The receptionist who never sleeps

To understand what happened, you need to know what eWUŚ is. It is a service run by Poland's National Health Fund (NFZ) that lets a front desk check within seconds whether a patient is entitled to publicly funded care. The receptionist types in a PESEL number, the system answers. That is how it is meant to work: quickly, without paperwork, at the counter.

Practice-management software — such as MyDr, used by thousands of healthcare providers — has that query built in. And this is where the plot begins. According to a statement by the Regional Prosecutor's Office in Poznań, the perpetrators gained unauthorised access to the accounts of employees at several medical providers using the platform. Then, exploiting the way the software was built, they launched a script that sent queries to eWUŚ in bulk.

Nobody broke down a door at the NFZ. Nobody carried a database out of a server room. The perpetrators walked in through the staff entrance and did exactly what that entrance is for — only millions of times over. The system saw a logged-in clinic employee and answered politely: first name, surname, PESEL, entitled to insurance or not.

There were no medical records, prescriptions or diagnoses in this haul. That matters, and we will come back to it.

Act two: four days

On 8 April 2024, following reports filed by the President of the NFZ, the prosecutor's office opens an investigation. On 12 April a daily query limit comes into force in eWUŚ for entities using its dedicated services — “for security reasons”.

Four days apart. CyberDefence24, in its account of the case, pauses at this coincidence and asks directly: how was it possible to pull the data of so many millions of people before that?

The answer is uncomfortable in its simplicity. A service that responds to a PESEL number with a first name and surname is an oracle for an attacker. A PESEL number has a known structure and a checksum, so valid numbers can be produced on an assembly line. If the oracle does not count the questions and is not surprised that a small clinic has suddenly taken an interest in half the country, the only thing protecting the entire register is the password to a front-desk account.

Act three: two years of silence

Then the case drops out of sight. The public does not know about it; the investigation moves at its own pace. The prosecutor's office, working with the Central Bureau for Combating Cybercrime, tracks down the suspects and — as it will later announce — recovers the entire unlawfully obtained database before it could be sold on.

That is good news, though it is worth reading carefully. “Recovering” data means securing the copies investigators managed to reach. It is not mathematical proof that no other copy was ever made.

So for two years this story has a beginning and a middle, but no audience. It will get one only when something much bigger happens.

Act four: August 2026. The same name, an entirely different case

In August 2026 the name MyDr hits the headlines. This time the data was not extracted from a state register through other people's accounts — it leaked from the platform itself. According to government information the incident may affect around 18.8 million people and more than 12,000 healthcare providers; the figure in circulation is rounded to 19 million. And, most importantly, the data includes health information.

The company says it is finalising its assessment of the scope of the breach and that it has found no evidence the data was published. The President of UODO, Poland's data protection authority, announces an inspection of the firm's technical and organisational safeguards, including its risk assessments. By 17 September the authority has received more than 50 complaints and reports from citizens and more than 2,000 breach notifications from providers. In September it decides on broader inspections of how health data is processed.

And then, on 18 August, right in the middle of this storm, the Regional Prosecutor's Office in Poznań publishes a statement about the case from two years earlier. Thirteen million people. MyDr in the background. The numbers almost match, the name is the same — and in a single evening the two stories are glued together in the comment sections into one tale of “a leak they had known about for ages”.

Act five: untangling

People in the industry are the first to set it straight. Zaufana Trzecia Strona, a Polish security news site quoted by CyberDefence24, writes that the numbers are similar by coincidence and the company in the background is the same, but the perpetrators are different, as are the method, the target, the source of the data and the course of events.

Let us put the two cases side by side:

The difference is not academic. A first name, surname and PESEL number are enough to attempt fraud. Health information is material for blackmail, discrimination and scams in which the caller “from the clinic” knows your medication and the date of your last appointment. A password can be changed. A medical history cannot.

Act six: October 2026. A courtroom, but no verdict yet

In August the prosecutor's office spoke of five suspects and the final stage of the proceedings. On 5 October 2026 it announced that an indictment against five men had been filed with the Regional Court in Poznań.

The charges include, among others, breaking security measures, unauthorised access to information, unauthorised processing of personal data, creating and sharing software designed for such offences and, in one case, money laundering. These carry sentences of up to 8 and up to 12 years in prison. According to prosecutors, individual suspects have admitted the charges and given extensive statements.

Precision is needed here: as of the date this article was published, no verdict has been handed down. Many write-ups already call the five men “convicted” — that is one stage too early. They are defendants, and guilt will be decided by the court.

The moral: what this story teaches

The easiest thing would be to close it with “MyDr again”. That would be convenient and untrue. It would be just as untrue to claim the two cases have nothing in common. Spring 2024 showed that an account in practice-management software is a fully fledged gateway to state systems — and that the warning signal sounded long before August 2026.

• A receptionist's account is a privileged account. If practice-management software can query state registers, the login and password protect far more than the appointment calendar.
• A verification service must not be an oracle. It needs limits per account and per provider, and an alarm when someone asks about people who have never been their patients.
• An integration inherits trust. The register trusts the software, the software trusts the logged-in user. Taking over the weakest link is enough to exploit the trust of the whole chain.
• One vendor is one big risk. A platform serving thousands of providers means a single incident has nationwide scale — regardless of how careful any particular practice is.
• Detection matters as much as prevention. Eighteen million queries do not happen in an hour. Every day of earlier warning means a smaller database in the perpetrators' hands.

If you are a patient

• Block your PESEL number in the mObywatel app or at a municipal office. It is the most effective protection against liabilities taken out using your data.
• Check whether the leak affects you — in the government service Bezpieczne Dane, to which this data set is due to be added — and read the notifications from the providers where you have been treated.
• Turn on alerts at the credit and business information bureaus.
• Do not trust phone calls “from the clinic” that know the details of your treatment and ask for an extra payment, a code, an app installation or a click on a link. Knowing your medical data is no longer proof that the provider is calling.
• Change the password to your clinic's patient portal and do not use it anywhere else.

If you run a healthcare practice

• Multi-factor authentication for every account in the practice-management system — with no exceptions “because the front desk is in a hurry”.
• Named accounts, no sharing. A shared login at a workstation makes it impossible to establish who sent a query and when.
• No accounts left behind by former employees and no test accounts.
• Log review: queries about people outside the patient list, activity outside opening hours, an unusual number of operations. The night receptionist from the first paragraph leaves traces — you only have to look at them.
• A data processing agreement does not release you from oversight. The provider remains the data controller: it is the one that reports the breach to UODO and notifies patients.
• A plan for an incident at the vendor: who reports, within what deadline, how to notify patients and how to work when the system is unavailable.

An epilogue that does not exist yet

The first story is waiting for a verdict. The second — for a finding on what exactly leaked, and for the results of the inspection. One question also remains open, the one CyberDefence24 asked back in August: whether any conclusions were drawn after spring 2024 that went beyond a daily query limit.

Because if the only lesson from the night when someone else's account interrogated half of Poland was a counter on the door — then the second story is no accident. It is a sequel.

Sources

This article is based on Oskar Klimczuk's piece “Druga historia z MyDr. 2 lata temu skradziono dane 13 mln osób” (“The second MyDr story: two years ago the data of 13 million people was stolen”), published on 18 August 2026 by CyberDefence24.pl. That piece is the source of the findings on the 2024 incident, cited from the statement of the Regional Prosecutor's Office in Poznań, of the distinction between the two cases and of the observation about the date the eWUŚ query limit was introduced. The opening scene illustrates the mechanism described by prosecutors; it is not a report from any specific provider. The technical assessments and recommendations are our own. Information on later developments in both cases comes from the other sources listed below.

• CyberDefence24.pl, Oskar Klimczuk, “Druga historia z MyDr. 2 lata temu skradziono dane 13 mln osób”, 18 August 2026 (in Polish): cyberdefence24.pl
• TVN24 Biznes, on the indictment in the 2024 case, 5 October 2026 (in Polish): tvn24.pl
• Personal Data Protection Office (UODO), statement on inspections following leaks of medical data, 25 September 2026 (in Polish): uodo.gov.pl
• Polsat News, the company's statement on establishing the scope of the incident, 18 August 2026 (in Polish): polsatnews.pl