Technology · News
Poland Indicts Five Men Over NFZ Health Insurance Data Breach Affecting 13 Million People
Published:
In brief
Polish prosecutors in Poznań have filed an indictment against five men accused of stealing the personal data of more than 13 million people from the National Health Fund's (NFZ) insurance-verification system. Investigators say the suspects ran over 18 million unauthorized queries through compromised medical-facility accounts in 2024, extracting names, national ID numbers and insurance status.
Poland's National Health Fund (Narodowy Fundusz Zdrowotny, NFZ) confirmed on 6 October 2026 that personal data belonging to more than 13 million people had been unlawfully extracted from its eWUŚ insurance-verification system, a day after the Regional Prosecutor's Office in Poznań announced an indictment against five men, according to tvn24.pl and tvp.info.
How the data was taken
According to the Poznań prosecutor's office, as reported by rynekzdrowia.pl and portalsamorzadowy.pl, the suspects did not break into NFZ's own infrastructure. Instead, they gained unauthorized access to employee or contractor accounts at two healthcare providers that use the MyDr medical-records platform. Through those accounts, they allegedly planted a script that automatically fired more than 18 million queries at eWUŚ — the electronic system doctors and clinics use to check whether a patient is entitled to publicly funded care.
NFZ said in its statement, cited by rynekzdrowia.pl, that healthcare providers are independent data controllers responsible for their own security measures, and that the agency's own systems were not breached directly.
Timeline: from the breach to the indictment
| Date | Event |
|---|---|
| 18–21 & 26–27 March 2024 | Automated queries extract data on roughly 11.1 million people via eWUŚ, per tvn24.pl |
| August 2026 | A related breach of the MyDr platform itself is publicly revealed, reportedly affecting data tied to up to roughly 19 million people, per rynekzdrowia.pl |
| 5 October 2026 | Poznań Regional Prosecutor's Office announces an indictment against five men, citing over 13 million victims and more than 18 million queries, per rynekzdrowia.pl and portalsamorzadowy.pl |
| 6–7 October 2026 | NFZ issues a public statement on the breach, per tvn24.pl, tvp.info and rynekzdrowia.pl |
Who is charged
The indictment names five men, identified in Polish reporting only by first name and last-initial. Prosecutor Anna Marszałek, quoted by portalsamorzadowy.pl, said all five defendants confessed and gave detailed explanations to investigators.
- Tomasz B. — accused of breaching the security systems and submitting the unauthorized eWUŚ queries.
- Jakub K. — accused of writing the scripts used to bypass security and distributing them to the others.
- Wojciech G., Patryk K. and Marcin W. — accused of unauthorized access to the system.
Prosecutors told rynekzdrowia.pl and portalsamorzadowy.pl that, depending on the specific charges each defendant faces, they could be sentenced to between 8 and 12 years in prison. Authorities also said the stolen database was fully recovered through cooperation between the Poznań prosecutor's office and Poland's Central Cybercrime Bureau.
What data was exposed
The compromised records included full names, PESEL numbers — Poland's 11-digit national identification number — and each person's status in the public insurance system, according to tvn24.pl, tvp.info and rynekzdrowia.pl. PESEL numbers are widely used in Poland to verify identity for banking, telecoms and government services, which is why tvn24.pl reported concerns about risks such as identity theft, fraudulent loan applications or unauthorized phone-line registrations.
What remains unclear
Reports from different stages of the case cite different victim counts: tvn24.pl initially referenced roughly 11.1 million people tied to the March 2024 eWUŚ queries, while the October 2026 indictment covered by rynekzdrowia.pl and portalsamorzadowy.pl cites more than 13 million victims and over 18 million queries. A separate, related compromise of the MyDr platform itself, revealed in August 2026, has been reported by rynekzdrowia.pl with a figure closer to 19 million affected records. None of the sources reviewed for this article fully reconciled why these totals differ, and it was not established in the material reviewed how long the Ministry of Digital Affairs or Poland's data protection authority (UODO) knew about the case before it became public.
Questions
- How many people were affected by the NFZ data breach?
- The October 2026 indictment from the Poznań prosecutor's office cites more than 13 million victims, based on over 18 million automated queries to the eWUŚ system. Earlier reporting on the March 2024 incident had cited a figure of around 11.1 million people.
- What personal data was exposed?
- According to NFZ and prosecutors, the exposed data included people's full names, their PESEL national identification numbers, and their status in Poland's public health insurance system.
- Was NFZ's own computer system hacked?
- NFZ says no — the agency states the attackers instead compromised employee or contractor accounts at two healthcare providers using the MyDr platform, and used those accounts to send mass automated queries to the eWUŚ verification system.
- Who has been charged, and what penalties do they face?
- Five men — identified as Tomasz B., Jakub K., Wojciech G., Patryk K. and Marcin W. — were indicted by the Poznań Regional Prosecutor's Office. Prosecutors said they could face between 8 and 12 years in prison depending on the specific charges, and that all five confessed.
- When did the breach happen, and when was it disclosed?
- The underlying queries were carried out in March 2024. The case became broadly public only in 2026: a related MyDr platform breach was revealed in August 2026, the indictment was announced on 5 October 2026, and NFZ issued its own public statement on 6–7 October 2026.
How the world is telling it
- PolishPolish outlets (tvn24.pl, tvp.info, rynekzdrowia.pl, portalsamorzadowy.pl) framed the story primarily around the prosecutor's indictment and NFZ's insistence that its own systems were not breached, placing responsibility on healthcare providers as independent data controllers for the MyDr platform's security.
Sources
- tvn24.pl — Potężny wyciek danych. Komunikat NFZ
- tvp.info — Wyciek danych z NFZ dotyczy 13 milionów osób. Śledztwo prokuratury i zarzuty
- rynekzdrowia.pl — Wykradli z NFZ dane 13 mln osób. Jest akt oskarżenia
- rynekzdrowia.pl — Wykradli dane za pośrednictwem systemu eWUŚ, NFZ wskazuje „słabe ogniwo”
- portalsamorzadowy.pl — Dane 13 mln pacjentów wykradzione z NFZ. Jest akt oskarżenia wobec pięciu mężczyzn
This piece was prepared with artificial intelligence and passed an automated source check before publication. If you see an error, ask for a correction. Request a correction or reply · How we make this
Related
TechnologyArticle
What Cryptocurrency and Blockchain Are, and How They Actually Work
Cryptocurrency is digital money secured by blockchain, a shared ledger that a network of computers maintains instead of a single bank. Transactions are grouped into blocks, checked by a consensus mechanism such as proof of work or proof of stake, and linked cryptographically so records cannot be rewritten without redoing the whole chain.
TechnologyNews
Nicolas Cage Says He 'Probably' Won't Work With Amazon Again After Refusing AI Waiver for 'Spider-Noir'
Actor Nicolas Cage said at New York Comic Con on October 10, 2026, that he refused to sign an artificial-intelligence waiver Amazon requested for his canceled series "Spider-Noir," and that he will "probably" not work with the studio again. Amazon canceled the show after one season despite 11 Emmy nominations and 2.6 billion minutes streamed in its first six weeks.
TechnologyNews
Musk pledges affordable Starlink pricing in India days before Jio's record IPO
Elon Musk said SpaceX would need to set affordable prices for Starlink in India, warning that otherwise few people would buy the service, intensifying his public dispute with Mukesh Ambani just before Jio Platforms launches what is billed as India's largest-ever IPO. Musk did not name a price. India's government says Starlink, Jio and Amazon's satellite venture are all still awaiting the same security clearance.
TechnologyArticle
How Starlink Satellite Internet Works, and Why India Is the Latest Battleground
Starlink is SpaceX's broadband network of thousands of satellites in low Earth orbit that beam internet directly to a dish on the ground, bypassing cables and cell towers. It matters now because Elon Musk has promised "affordable" Starlink pricing in India just as Mukesh Ambani's Jio Platforms prepares a record-breaking IPO, reigniting a dispute over competition and security clearance.