Incident at MyDr – patient information
Key information
- The incident occurred at the software provider MyDr.
- We have no information confirming that our patients’ data was affected. We have asked the provider to clarify this.
- We are publishing this information as a precaution – so that you hear about it from us and we can explain appropriate steps.
- The practices are operating as usual. Appointments, visits and booking remain unchanged.
What happened?
On 12 August 2026, Poland’s Ministry of Digital Affairs confirmed that an unauthorised person had accessed data at MyDr, a provider of electronic medical record systems. Thousands of medical practices and clinics in Poland use this system.
The incident concerns the provider’s infrastructure. Our computers, network and accounts were not compromised; our practice systems were not breached.
What remains unknown and why we are informing patients now
The provider has not yet told us whether our patients’ data was affected. If it was, we do not know the scope. We therefore cannot state that your data was leaked. However, we do not want to delay this information until every detail has been established.
We want you to hear about this from us, calmly and with practical advice, rather than through a headline. This page is where we will publish updates.
Which data could potentially be involved
The medical records system contains information entered by healthcare providers: names, PESEL numbers, dates of birth, contact details, NFZ branch information and health data, including appointments and prescriptions.
We emphasise: We currently have no confirmation that this happened to our patients’ data. We are being open because we believe you should have the full picture, including what remains uncertain.
What this could mean in practice
If our patients’ data was affected, the main risk would be attempted fraud: calls and messages impersonating a practice, pharmacy, the NFZ or a bank. Knowing your name and appointment details can make such messages sound convincing. A PESEL number may also be used in attempts to take out financial commitments in someone else’s name.
This is why the first two steps below matter: restricting use of your PESEL number and being alert to suspicious calls and messages.
What we are doing
The provider has said it will inform the organisations using its system of the scope where necessary. We are awaiting that information and have also requested it in writing. We monitor notices from the provider, the Ministry of Digital Affairs and Poland’s data protection authority, UODO.
We have also secured access to our system accounts. Once the scope is known, we will assess whether patients of our practices are affected.
What you can do now
Four steps worth considering regardless of this particular incident.
- Restrict use of your PESEL number. You can do this through mObywatel, a bank, a post office or a municipal office; it takes a few minutes. The restriction is intended to prevent others from taking out loans or phone contracts in your name. You can lift it when needed for your own transactions.
- Check your data using the government service. On the website bezpiecznedane.gov.pl you can check whether your data appears in known leaks.
- Remain alert to suspicious calls and messages. If someone calls or writes about a prescription, test result, extra payment or data verification, end the contact and call us using the number on our website. Do not follow links in such messages.
- Do not disclose your PESEL number, password, SMS code or card details. Not even to us – we do not ask for such details.
Recognising communications from us
We do not request PESEL numbers, passwords, SMS codes or payment card details by text, email or messaging apps. We do not send payment links for appointments. If you receive such a message claiming to be from the practice, do not reply; call us instead.
Appointments continue as usual
Appointments with Dorota Żółkowska and Tomasz Żółkowski are arranged by phone using the numbers listed for their practices.
The controller of your data is the practice run by the doctor treating you. Details are provided in the privacy notices: K. Żółkowski, D. Żółkowska, T. Żółkowski.
We are publishing this notice as a precaution before the scope is confirmed. If the provider’s findings show that our patients’ data was affected, we will seek to notify each person individually where contact details are available, in accordance with Article 34 GDPR.
Update history
- Additional practical information for patients.
- Added information on individual notifications.
We will update this page as further information becomes available.