Polish Medical Software Hit by Cyberattack, Patient Data Stolen

A SQL injection attack against Qbusoft's Medyc platform (exploited between 22–23 Aug 2026) allowed an attacker to export an encrypted database and confirmed exposure of patients' identifying and contact data; forensic evidence suggests medical records may also have been targeted but theft of health records was not definitively confirmed. Qbusoft fixed the vulnerability, rotated secrets, restricted permissions and implemented monitoring while Polish authorities investigate and affected individuals are advised to watch for fraud.