On August 12, 2026, Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski announced one of the largest data security incidents in Polish history. A cyberattack on the systems of MyDr, a provider of electronic medical records software, resulted in unauthorized access to data covering up to 19 million individuals. The stolen database contains over 2 terabytes of information, including PESEL numbers, addresses, and particularly sensitive health data: treatment history, medication use, prescriptions, and doctor visits. The Central Bureau for Combating Cybercrime, the Personal Data Protection Office, and the Joint Cybersecurity Operations Center are already investigating the matter.
The scale of this incident – both in terms of the number of people whose data was leaked and the sensitivity of that data – makes it a striking example of the risk against which the legislator has been trying to protect Polish companies and institutions through new cybersecurity regulations for several months.
What are the threats to entities whose data has been leaked and to the company itself?
Under the GDPR, a data controller whose systems have been breached is obligated to report the incident to the President of the Personal Data Protection Office (UODO) within 72 hours of its discovery, and in the case of a high risk of infringement of the rights and freedoms of individuals, also to notify the data subjects directly. In the case of medical data, which falls into the category of sensitive data, this risk is almost always considered high. The consequences of such a breach may include:
- administrative fines imposed by the Personal Data Protection Office, up to EUR 20 million or 4% of the annual global turnover,
- claims for compensation from injured parties (including claims for compensation for infringement of personal rights),
- civil and image liability of the company and its contractors,
- real risk of secondary attacks – phishing, extortion and blackmail against people whose data has been disclosed.
But that's not all. If a company processing medical data qualifies as a key or important entity under the new regulations on the national cybersecurity system, additional obligations and sanctions, separate from the GDPR, are on the horizon.
NIS2 is already in force in Poland – and it applies to a much wider range of entities than it seems
On April 3, 2026, an amendment to the National Cybersecurity System Act (NCS Act) entered into force, implementing the EU NIS2 Directive (Directive 2022/2555) into Polish law. The healthcare sector – including healthcare service providers, but also suppliers of systems and software supporting these entities – was explicitly identified as a key sector covered by the new regulations.
The most important changes introduced by the amended act are:
- Radical expansion of the scope of entities covered by the current act – from approximately 400 entities to as many as approximately 42,000 companies and institutions across Poland.
- Self-identification mechanism – it is the entrepreneur’s responsibility to determine whether his or her activities qualify him or her as a key or important entity and to submit a notification to the appropriate register.
- Short, rigid implementation deadlines – 6 months for self-assessment and registration, 12 months for implementing a full information security risk management system.
- New, strict incident reporting deadlines – initial report within 24 hours of incident detection, in-depth report within 72 hours, final report within a month.
- Personal liability of management for negligence in the area of cybersecurity, regardless of the liability of the company itself.
- The obligation to secure the entire supply chain, which means that the requirements also cascade down to subcontractors and IT suppliers – even if they are not formally subject to NIS2 themselves.
- Severe financial penalties – for key entities up to EUR 10 million or 2% of annual turnover, for important entities up to EUR 7 million or 1.4% of annual turnover.
The situation of a company handling the medical records of millions of patients clearly shows why the legislator has placed this sector under special supervision: a failure or hack in one technological entity can immediately translate into a breach of data security for the entire population using a given healthcare system.
Why does this case affect a much wider range of companies than you might think?
Many businesses wrongly assume that the new cybersecurity regulations apply only to large critical infrastructure operators such as those in the energy, telecommunications, and financial sectors. However, the obligations now also apply to, among others:
- healthcare entities and providers of services and software for the healthcare sector,
- digital, cloud and data center service providers,
- companies from the food production, waste management and chemical sectors,
- subcontractors and IT suppliers cooperating with key entities – regardless of their size.
The threshold for becoming subject to NIS2 obligations is a minimum of 50 employees or €10 million in annual revenue. This means that many medium-sized technology companies – such as providers of systems for clinics, hospitals, and pharmacies – are already subject to these regulations, often without even realizing it.
How can we help?
Our law firm has been supporting entrepreneurs in the area of personal data protection and information security for years, and in connection with the entry into force of the amendment to the KSC Act, we have also developed a dedicated NIS2 implementation practice, consisting in particular in:
- Qualification audit and self-assessment of status – determining whether and to what extent your activity is subject to the provisions on KSC as a key or important entity, together with preparing an application to the appropriate register.
- Implementation of an information security management system (ISMS) in accordance with the requirements of the Act, adapted to the specificity and scale of the client's operations.
- Developing and implementing incident response procedures, including reporting procedures in line with the new 24/72 hour deadlines and procedures for reporting personal data breaches to the Personal Data Protection Office.
- Preparing contracts with suppliers and subcontractors that take into account supply chain security requirements resulting from both NIS2 and the GDPR.
- Advice and representation in proceedings before the President of the Personal Data Protection Office and competent authorities for cybersecurity, as well as handling claims of persons injured as a result of violations.
- Training for management and employees, covering both legal requirements and practical aspects of incident response – taking into account the personal responsibility of management board members.
Events such as yesterday's data leak from MyDr systems show that the cost of failing to implement appropriate security measures and procedures – both financial and reputational – may turn out to be many times higher than the cost of preparing for the new requirements in advance, given that the statutory deadlines for adapting to NIS2 are already running out and the first inspections and proceedings remain a matter of time.
To verify compliance with the obligations and regime of the NIS2 Directive, assess your preparedness in the event of a security incident, or provide support in the event of an incident or data breach that has already occurred, please contact our office. We will comprehensively guide you through the entire process of adapting your organization to the new regulations – from audit, through implementation, to ongoing incident management.
This article is for informational purposes only and does not constitute legal advice.
The facts regarding the incident involving MyDr are based on media reports from August 12–13, 2026 and are subject to change.
Author:
