MyDr sp. z o.o.

Poland's Central Bureau for Combating Cybercrime launched an investigation on August 12, 2026 after MyDr, an electronic health records vendor used by over 10,000 Polish clinics, suffered unauthorized access exposing roughly 18.8 million patients' data (about half of Poland's population), including PESEL national ID numbers, names, contact details, diagnoses, and prescription records from 12,000+ facilities. Because MyDr is a data processor rather than a controller under GDPR, it could not directly notify affected patients, instead relying on client clinics to pass notifications along, delaying individual disclosure. MyDr said its systems were secure and that no evidence of public sale of the stolen data had been found as of the investigation's start.