Polish authorities are rotating the digital certificates that connect medical systems to the national health platform, without evidence that any were stolen.

 

What happened

Polish authorities are investigating an attack on MyDr, a privately held company supplying software to doctors, clinics, and other healthcare providers, that may have exposed data belonging to nearly 19 million people and more than 12,000 medical facilities, The Record reported on August 17, 2026. The company said it had identified and removed the cause and added security measures, without describing the vulnerability or how attackers got in, having earlier attributed the incident to external, intentional criminal activity. Government investigators determined that the intruders reached historical data held in MyDr systems through April 2024, and that the exposure may not extend to every customer or patient. MyDr's software connects healthcare providers to P1, the nationwide electronic health platform handling electronic prescriptions and referrals.

 

Going deeper

Separating what has been established from what has been claimed matters in this case, because most of the detail circulating comes from the attackers. People claiming responsibility contacted a Polish cybersecurity publication with what they described as evidence, including a screenshot containing information belonging to a prominent politician, and the samples reported suggest the material could include names, dates of birth, identification numbers, prescription information, and medical records. None of that has been independently verified. What the company has confirmed is narrower, covering the intrusion itself, the removal of its cause, and the absence of evidence that affected data has been published anywhere. Poland's Personal Data Protection Office plans to inspect MyDr while security agencies work to identify those responsible, and no threat actor has been named.

 

What was said

"If the investigation finds that the company failed to follow proper procedures or adequately protect its systems, it will face legal consequences," said Krzysztof Gawkowski, Poland's Digital Affairs Minister, as reported by The Record. Health Minister Jolanta Sobierańska-Grenda said the incident posed no threat to the country's public healthcare systems and that P1 remained secure, and MyDr has stated its systems remain operational and safe for doctors and patients.

 

In the know

The response worth studying is the one taken without waiting for evidence. Poland's e-Health Center is replacing the digital certificates that medical systems use to authenticate to P1, a precaution Gawkowski described despite investigators finding no indication the certificates were stolen or misused in the attack. A digital certificate proves a system is what it claims to be, so a certificate obtained by an intruder allows connections that look entirely legitimate to the receiving platform, potentially long after the original intrusion is closed. Rotating them removes that option before anyone establishes whether it exists. Officials said the replacement should not interrupt electronic prescriptions or referrals for patients.

 

The big picture

American healthcare runs on the same trust mechanism without much visibility into its condition. Certificates authenticate connections to health information exchanges, secure messaging networks, and application programming interfaces, and they secure email in transit between organizations. Paubox's analysis of healthcare email traffic examined 803,378 unique outbound relays over one week and found roughly 4% went to servers whose identity could not be fully verified, with 3.35% presenting self-signed certificates and 0.48% presenting expired ones. Organizations that cannot see the certificate posture of the servers they already send protected health information to are not positioned to decide what to rotate after a vendor compromise. The practical question raised by this incident is one any covered entity can ask before it becomes urgent, which is which vendors hold certificates that authenticate to internal systems, who tracks their expiry and issuance, and how quickly they could be replaced if a vendor disclosed a breach tomorrow.

 

FAQs

Why replace certificates when none were confirmed stolen?

Establishing what an intruder took can require months, and a stolen certificate is useful to an attacker throughout that period. Rotation closes the possibility at a known cost rather than leaving it open while investigators work, which is why it appears frequently in incident response guidance as a containment step rather than a remediation one.

 

What is the difference between a self-signed and a trusted certificate?

A trusted certificate is issued by a recognized authority that has verified the holder's identity, giving the receiving system independent grounds to believe the connection is genuine. A self-signed certificate is created by the server presenting it, so nothing outside that server vouches for it, and the identity claim cannot be checked.

 

Does HIPAA require particular certificate practices?

The Security Rule does not name certificate types, though it does require organizations to ensure the integrity of transmitted electronic protected health information. A connection secured by a certificate whose validity cannot be established leaves that requirement difficult to demonstrate, which is where the practical obligation sits.

 

How would a US organization learn a vendor had been breached in another country?

Often through news coverage rather than notification, since foreign vendors may have no obligation to notify American customers directly and timelines vary by jurisdiction. Contracts with international vendors should specify notification requirements explicitly rather than assuming local regulation covers it.

 

What should a certificate inventory contain?

Every certificate in use with its issuer, expiry date, the system it authenticates, and the person responsible for renewing it, including certificates held by vendors that connect inbound. Organizations frequently discover during an incident that no such list exists, which is the point at which building one becomes considerably harder.