Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider

September 29, 2026 at 02:17 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Hackers stole patient data from Qbusoft, a Polish medical software maker, weeks after a breach at another provider exposed records of nearly 19 million people. The data comes from Medyc, a platform used by medical offices and clinics to manage patient registration, records and prescriptions. Qbusoft confirmed the theft on September 25, while a clinic using Medyc said the attacker exploited an SQL injection vulnerability on August 22–23, 2026.

Key Facts

Qbusoft confirmed on September 25 that attackers gained unauthorized access to personal data stored on Medyc’s infrastructure and stole it.
The confirmed stolen data includes names, PESEL numbers, home addresses, phone numbers and email addresses.
The Odwykowo-Psychiatryczny Ośrodek Leczniczy in Inowrocław said the attacker exploited an SQL injection vulnerability on August 22–23, 2026.
The attacker took the personal data of every patient treated at the clinic’s addiction day unit between July 1, 2024 and August 23, 2026.
In August, attackers stole data on nearly 19 million people from MyDr, a Warsaw-based company whose software is used by about 12,000 healthcare facilities.

The Breach

Qbusoft recorded “dangerous attacks” on its infrastructure on September 9 and reported the incidents to the Central Cybercrime Bureau (CBZC), the Personal Data Protection Office (UODO), CSIRT NASK, the e-Health Center and the Social Insurance Institution (ZUS). The company said its systems have been hit by repeated attack attempts over the past week, and that the service may periodically run slower or have limited access to some modules. Qbusoft has not shared details on how many people were affected. The clinic’s notice states that the data export commands had no time limit, allowing the attacker to take the personal data of every patient treated at its addiction day unit between July 1, 2024 and August 23, 2026.

Data Exposure

The database stored names and PESEL numbers in encrypted form, but the clinic’s notice states that the vendor instructed it to assume the data was easy to decrypt and that the attackers gained access to it in plain text. The attacker also ran scripts against database tables holding medical data. The leaked MyDr database held PESEL numbers, contact details, and information about patients’ visits, prescriptions and treatment history.