2026 Qbusoft/Medyc (Poland) — clinic confirms patient PII breach; CBZC investigating

Verified facility + government acknowledgment — September 25–26, 2026. Inowrocław Rehabilitation and Psychiatric Treatment Center said a cyberattack on Qbusoft’s Medyc software breached confidentiality of patient personal data (contact details and PESEL national IDs may be included). Digital Affairs Minister Krzysztof Gawkowski said Poland’s Central Bureau for Combating Cybercrime (CBZC) is examining the incident in a broader investigation and that Qbusoft had not properly reported to services; government issued new security recommendations for healthcare software vendors. Zaufana Trzecia Strona / Polish press: intrusion ~Aug 22–23, 2026; vendor learned ~Sep 8–9; possible SQL injection; actor “fingerprint” claims 5M people + 8M images — unverified. Official nationwide census unpublished — recordsAffected 0; companyConfirmed true for confirmed confidentiality breach at least at reporting facilities. Catalog separately from mydr-poland2026.