> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider
- URL: https://f4n6.co.uk/security-feed/hackers-exploit-sql-injection-flaw-to-steal-patient-data-from-polish-medical-software-provider/
- Published: 2026-09-29T23:54:42.000Z
- Updated: 2026-09-29T23:54:42.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Attackers exploited an SQL injection vulnerability in the application interface of Medyc, a patient management platform sold by Polish vendor Qbusoft to medical offices and clinics, and moved an encrypted database archive off the vendor's infrastructure. Qbusoft confirmed unauthorised access and theft of names, PESEL numbers (the Polish national ID), home addresses, phone numbers and email addresses, and has not disclosed how many people are affected. The intrusion is the second major Polish healthcare data theft in two months: in August attackers took records on nearly 19 million people from MyDr, a Warsaw company whose software is used by about 12,000 healthcare facilities. No CVE, CVSS score or CISA KEV entry is available for this item, and no threat actor has been named or attributed. The direct risk to EMEA financial services is second-hand but real: PESEL numbers, addresses and phone numbers are the identity attributes used in Polish account opening, KYC refresh and customer authentication, and the same SQL injection class sits in customer-facing portals across the sector.

## 2\. Regulatory framing

| Article                                                | Trigger (the fact in this item)                                                                                                                                                     | Practical impact                                                                                                                                                                                                                                                     |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles | Qbusoft is a software vendor whose Medyc platform holds patient data for client clinics; the compromise occurred inside the vendor's infrastructure, not the clinics'.              | Firms running healthcare-sector exposure, occupational health schemes or Polish subsidiary operations should confirm whether any third-party platform in scope holds PESEL-linked records and what contractual breach-notification and forensic-access rights exist. |
| NIS2 Art. 21(2)(d): supply chain security measures     | The breach entered through a vendor's application interface and the vendor's own remediation (permission restriction, secret rotation) was the only control applied to client data. | Entities in NIS2 scope should treat application-layer vendor platforms as supply chain risk: verify the vendor's input validation and database permission model, not just its contractual assurances.                                                                |

No DORA incident-reporting article is engaged on the facts available: the affected entity is a Polish medical software vendor and its clinic customers, not an EMEA financial entity, and no financial-sector incident is described. UK NIS 2018 is not engaged; the incident is in Poland and no UK OES or RDSP is named.

## 3\. Technical analysis & attack chain

Confirmed steps, as described by the Inowrocław addiction and psychiatric treatment centre (Odwykowo-Psychiatryczny Ośrodek Leczniczy) in its patient notification of 24 September 2026, based on Qbusoft's forensic findings:

1. On 22–23 August 2026 an unauthorised person exploited an SQL injection vulnerability in the Medyc application interface.
2. The attacker used that flaw to move an encrypted archive of the database outside the vendor's systems.
3. The attacker also ran scripts against database tables holding medical data.
4. The activity was detected on the night of 8–9 September 2026, roughly two and a half weeks after the initial exploitation.
5. Qbusoft removed the vulnerability the same day it discovered the attack, restricted database permissions, forced rotation of all passwords and technical secrets, and placed its infrastructure under constant monitoring.

The clinic states the data export commands had no time limit, which it interprets as meaning the attacker took the personal data of every patient treated at its addiction day unit between 1 July 2024 and 23 August 2026\. Names and PESEL numbers were stored encrypted, but the clinic's notice says that because of how the code was built, Qbusoft instructed it to assume the data was easy to decrypt and that the attackers obtained it in plain text. The vendor also told the clinic it is highly likely the attackers obtained medical records in the form of hospital discharge summaries.

The technical picture is thin beyond the injection class. No CVE identifier, affected Medyc version, endpoint path, parameter name, database engine, payload, web shell, persistence mechanism, command-and-control channel or lateral movement is described in the source material. The SQL injection was in the application interface, which places it in the web-facing tier rather than in an internal system, but the source does not say whether the interface was internet-exposed, authenticated, or reachable only from clinic networks. Treat the absence of that detail as an information gap, not as evidence the exposure was limited.

Qbusoft's own statement, published on the Medyc website on 25 September 2026, confirms unauthorised access to personal data on Medyc infrastructure and its theft, and lists the confirmed data as names, PESEL numbers, home addresses, phone numbers and email addresses. It states that theft of medical documentation has not been confirmed at this stage, which sits in tension with the clinic's account that discharge summaries were highly likely taken. Both statements can be true if the vendor's confirmation is limited to what forensics have positively proven; the discrepancy is unresolved in the source material. Qbusoft recorded "dangerous attacks" on 9 September and says its systems have been hit by repeated attack attempts over the past week, with periodic service slowness and temporary loss of access to some modules as a result.

Attribution is unconfirmed. No actor, group or motivation is named in any source, and no MITRE ATT&CK profile is available for this item. The August MyDr breach is referenced only as context; the sources do not state that the two incidents share an actor, a toolset or a technique beyond the sector and the country.

Two confidence caveats apply. First, the detailed attack chain (SQL injection, export commands without a time limit, scripted access to medical tables) rests on a single source, the Inowrocław clinic's patient notice, relayed by Help Net Security; Qbusoft's own statement does not describe the mechanism. Second, the scope of data taken is disputed between vendor and clinic as noted above. Verify both against the vendor's forensic report before relying on either for notification or remediation decisions.

## 4\. Mitigation & containment

P1, within 24 hours:

- If any Polish subsidiary, occupational health provider or clinic-facing service uses Medyc, contact Qbusoft for the forensic report and the list of affected database tables, and treat all patient data held in the platform as exposed. Qbusoft has not published an affected-population count, so scope cannot be derived from the vendor statement alone.
- Audit internet-facing application interfaces for SQL injection in the same class: parameterised queries or prepared statements on every database call, input validation at the interface boundary, and a web application firewall in blocking mode as a compensating control where code changes cannot ship immediately. The Medyc flaw was in the application interface, so the control that matters is at that layer.
- Restrict database account permissions so that the account serving the application interface cannot read tables outside its function, and cannot run bulk export or file-write operations. Qbusoft applied exactly this control after discovery; it should have been in place before.
- Rotate all passwords and technical secrets for any system that shares credentials or configuration with the affected platform, following Qbusoft's own post-incident action.

P2, within 72 hours:

- Review database query logging and export activity for the window 22 August to 9 September 2026 on any comparable platform, looking for bulk SELECT or export commands against patient or customer tables with no row limit or time bound. The absence of a time limit on the export commands is the specific weakness the clinic identified.
- Where PESEL numbers, addresses or phone numbers from an affected platform are used in customer identification, account recovery or KYC refresh, add out-of-band verification for changes to contact details and for account recovery requests. The clinic warned that scammers could contact patients, cite their treatment history and offer fake medical or therapy services; the same data supports convincing impersonation against a bank.
- Confirm breach-notification and forensic-access clauses in contracts with any application-layer vendor holding regulated data, and confirm the vendor's obligation to notify within a defined window. Qbusoft detected the intrusion on 8–9 September and published its statement on 25 September.

P3, within 7 days:

- Add SQL injection and anomalous bulk-export detection to application and database monitoring for customer-facing platforms, and test it against a synthetic export of the kind described here.
- Review whether any third-party platform in the supply chain holds national identity numbers or equivalent identifiers, and whether the vendor's database permission model has been independently tested. This is the supply chain control that NIS2 Art. 21(2)(d) points at.

No vendor patch, version number or fixed release is named in the source material. Qbusoft states it removed the vulnerability on the day of discovery; there is no published version to pin to.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. No file hashes, domains, IP addresses, URLs, file paths, registry keys or process names are given in any source.

The sources describe observable behaviours but no atomic indicators. Those behaviours are set out below.

### Behavioural indicators

| behaviour                                                                               | where to observe                                                        | confidence                                                      |
| --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | --------------------------------------------------------------- |
| SQL injection against an application interface followed by export of a database archive | Web server and WAF logs, database query logs, outbound transfer records | Single-sourced (clinic notice); verify against vendor forensics |
| Scripted queries against medical data tables                                            | Database query logs and audit trails                                    | Single-sourced (clinic notice)                                  |
| Bulk data export commands with no time limit or row bound                               | Database query logs, export job history                                 | Single-sourced (clinic notice)                                  |
| Repeated attack attempts against the same infrastructure over a sustained period        | WAF, IDS/IPS, authentication logs                                       | Vendor statement (Qbusoft)                                      |

## 6\. Detection

Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values attributable to the threat. The only named artefacts are the vendor, the product and the vulnerability class, none of which are threat artefacts. A rule built on those would detect reporting about the incident, not the activity.

Detection effort should go to the behavioural layer instead: alert on database export operations that lack a row limit or time bound, on queries against patient or customer tables from accounts that do not normally touch them, and on SQL injection patterns at the application interface. Those are log-side detections, not file-side ones, and the source material does not supply the exact strings needed to write them.

## 7\. Sources

- Help Net Security, "Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider", https://www.helpnetsecurity.com/2026/09/29/qbusoft-medyc-data-breach-poland/, 29 September 2026.
- Qbusoft statement on the Medyc website, published 25 September 2026, as reported by Help Net Security (no direct URL supplied in the source material).
- Odwykowo-Psychiatryczny Ośrodek Leczniczy (Inowrocław) patient notification, 24 September 2026, as reported by Help Net Security (no direct URL supplied in the source material).
- Krzysztof Gawkowski, Deputy Prime Minister and Minister of Digital Affairs, post on X regarding the CBZC investigation, as reported by Help Net Security (no direct URL supplied in the source material).

## 8\. Adverse Trace position

Adverse Trace assesses this as a confirmed data-theft incident with a clear technical cause (SQL injection in an application interface) and an unclear scope: the vendor has not published an affected-population count, the mechanism rests on a single clinic's account rather than the vendor's own forensic disclosure, and the vendor and clinic disagree on whether medical documentation was taken. No CVE, CVSS score or CISA KEV entry exists for this item, and no actor is attributed, so we are not assigning a vulnerability severity. The client impact for EMEA financial services is indirect but concrete: PESEL numbers, addresses and phone numbers are identity attributes used in Polish account opening and customer authentication, and the SQL injection class that caused this breach is present in customer-facing portals across the sector. We will track Qbusoft's forensic disclosure and any CBZC statement for scope and mechanism detail, and we will reissue this advisory if a CVE is assigned, if an affected-population figure is published, or if the MyDr and Qbusoft incidents are linked to a common actor. Clients with Polish operations or healthcare-sector exposure should treat the P1 items in §4 as the immediate action set and should not wait for the vendor's scope figure before reviewing database permissions and export controls on their own application interfaces.

---

[Read the original source →](https://www.helpnetsecurity.com/2026/09/29/qbusoft-medyc-data-breach-poland/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*