← Qbusoft (Medyc)

2026 Qbusoft/Medyc (Poland) — clinic confirms patient PII breach; CBZC investigating

2026 Unknown records affected Share on X

Data compromised

Per Rehabilitation and Psychiatric Treatment Center in Inowrocław: confidentiality of patients’ personal data breached; may include contact details and national ID (PESEL) numbers; health-status information also cited in Polish coverage. Nationwide census unpublished. Actor “fingerprint” claims (~5M people / 8M private images) remain unverified. Distinct from verified MyDr ~19M incident (mydr-poland2026).

Technical writeup

Verified facility + government acknowledgment — September 25–26, 2026. Inowrocław Rehabilitation and Psychiatric Treatment Center said a cyberattack on Qbusoft’s Medyc software breached confidentiality of patient personal data (contact details and PESEL national IDs may be included). Digital Affairs Minister Krzysztof Gawkowski said Poland’s Central Bureau for Combating Cybercrime (CBZC) is examining the incident in a broader investigation and that Qbusoft had not properly reported to services; government issued new security recommendations for healthcare software vendors. Zaufana Trzecia Strona / Polish press: intrusion ~Aug 22–23, 2026; vendor learned ~Sep 8–9; possible SQL injection; actor “fingerprint” claims 5M people + 8M images — unverified. Official nationwide census unpublished — recordsAffected 0; companyConfirmed true for confirmed confidentiality breach at least at reporting facilities. Catalog separately from mydr-poland2026.

Root cause

Cyberattack on Qbusoft Medyc healthcare software (facility notice; Digital Affairs Minister / CBZC investigating). Industry reporting cites Aug 22–23 intrusion / early-Sep discovery; SQL injection claimed by trade press — treat technical path as reported, not DoD-style attestation

References

Breaches you may like