A company providing software for dental surgeries across Poland has confirmed a major data breach that may have exposed the personal and medical information of over two million people, according to Spider’s Web – technologie.
FELG Software sp. z o.o. issued an official statement acknowledging that a hacker claiming to be a member of the “fingerprint” group gained access to personal data of patients whose information had been entrusted to the company for processing.
The firm explained that the person claiming responsibility for the attack obtained access to approximately 10 per cent of the database and is demanding a ransom in exchange for not releasing the information publicly.
FELG Software said it is working to establish the true scale of the breach and identify which patients’ data may have been compromised. The company told dental surgeries not to report the incident to PUODO – Poland’s data protection authority – until it has formally confirmed whether their specific practice has been affected.
Medical records and PESEL numbers at risk
According to the technology news portal Zaufana Trzecia Strona, which spoke to the company, the breach could affect data belonging to more than two million individuals. The compromised information includes names, PESEL numbers (Poland’s national identification number), addresses, medical records, and details related to electronic prescriptions, sick leave certificates and verification in the eWUŚ system.
The perpetrator also provided the portal with prescription data for medications including Xanax and Ozempic, claiming to have found numerous prescriptions issued by dentists for drugs unrelated to dental treatment. The portal was unable to verify these claims.
Initially, the attacker suggested links to the “fingerprint” group, which has been linked to recent attacks on MyDr and Medyc. However, in conversation with Zaufana Trzecia Strona, the person responsible admitted this was intended to “make a bigger impression on the victim in the ransom process”. The fingerprint group itself has denied involvement and even offered to help the company, according to the same source.
The individual behind the attack has stated they plan to put the stolen database up for sale and do not intend further “public actions”.
Part of a wider wave of attacks
The FELG Software breach is the latest in a series of cyber attacks on Poland’s healthcare sector. Krzysztof Gawkowski, the minister for digitalisation, wrote that recent weeks have seen increasing activity by cybercriminals targeting medical organisations, and the entire sector must redouble its security efforts.
Following the MyDr and Medyc attacks, deputy digitalisation minister Michał Gramatyka told Wirtualna Polska’s “Tłit” programme that security services confirmed the data had not been sold or released. He said the hackers were not treating the attacks as opportunities to destroy or sell data, but rather to draw attention to inadequate security levels.
Gawkowski announced that the Ministry of Digitalisation is working on new regulations to strengthen the protection of medical data, including mandatory certification and limits on the processing of medical information by private entities.
Separately, Fakturownia, an invoicing service, confirmed an unauthorised person gained access to its systems and copied a large portion of its database. The incident affects every account on the platform, and the company began sending individual notifications to account holders from 1 October.
What this means for Poles in Poland
If you have visited a dental surgery in Poland that uses FELG Software, your PESEL number, address, medical history and prescription records may have been compromised. FELG Software has stated it will contact affected dental practices within the coming days and provide free mechanisms for notifying patients.
Those affected should watch for suspicious activity, including identity theft attempts or fraud using PESEL numbers. If your dental practice confirms your data was involved, you may wish to consider reporting the breach to PUODO yourself and requesting information on what protections are being put in place.
For Poles living abroad who maintain medical records in Poland or have family members using Polish healthcare services, it is worth checking whether their dentist uses FELG Software and whether they have been notified. The breach highlights the importance of monitoring financial accounts and being cautious about unexpected communications requesting personal information.
The government has promised stronger regulation of private companies handling medical data, but in the meantime, patients have limited control over how third-party software providers protect their information once it has been shared with a healthcare provider.
