The minister warns against the consequences following the cyber attack on Qbusoft

The minister said on Thursday evening on website X that the case is part of a broader investigation conducted by the Central Bureau for Combating Cybercrime.

"CBZC, as part of a broader investigation, is conducting activities related to a cybersecurity incident concerning, among others, software from Qbusoft Sp. z o. o., which creates the Medyc software," wrote Krzysztof Gawkowski.

Patient data may have been compromised

The Detox and Psychiatric Treatment Center in Inowrocław informed about the cyberattack on Thursday. The facility reported that the system of its data processing entity, Qbusoft from Olsztyn, was attacked.

According to the center's announcement, the breach of data confidentiality could include, among others: contact details, PESEL numbers and information about patients' health condition.

"Investigative analyzes conducted by MyDr confirmed that the incident has been contained and that there is no evidence of further unauthorized access to systems," the facility said.

The company did not report the incident

Gawkowski noted that Qbusoft - according to current information - did not report the incident to either CERT Polska or CSIRT CeZ, the security incident response team operating at the e-Health Center.

The minister announced consequences if the company violated applicable safety procedures.

"If a private company violates any security procedure, there will be strict consequences," he said.

CSIRT CeZ and the Ministry of Health have developed security recommendations for providers of software used in health care. The documents, in connection with threats in cyberspace and attacks on medical facilities and system manufacturers, were submitted to companies on September 16, 2026 for implementation.

In August, the Ministry of Digitization reported another serious incident - a cyber attack on the MyDr company. According to the ministry, the data of 19 million Poles was leaked, including information on medications and prescriptions. The data was supposed to come from 12,000. medical entities using the MyDr platform.