Fingerprint, who took data on over 18 million Poles from MyDr, stole Qbusoft's Medyc.pl patient database by SQL injection, Zaufana Trzecia Strona reports. Qbusoft is the second Polish medical-practice software vendor the actor has breached, and one Inowrocław clinic has had patient data taken in both leaks.
Publishers:zaufanatrzeciastrona.pl
Reality
- Evidence50
- Adoption30
- Hype gap+5
- Incentives
- Insufficient
- Confidence55
Qbusoft confirmed an attacker stole patient data from its Medyc clinic software through an SQL injection flaw that went unnoticed for about 17 days. It is the second Polish clinic-software supplier to lose ID numbers in weeks, after MyDr lost data on nearly 19 million people in August.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 54%
- Investor
- Investor 18%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+5
- Incentives55
- Confidence72
DC's Department of Health Care Finance says two public summary reports exposed underlying records on 399,086 people. The data sat behind pages built to show enrollment counts and was reachable from 2023 until July 2026, when the agency found and pulled the reports.
Perspective Coverage
3 publishers
- Builder
- Builder 15%
- Operator
- Operator 78%
- Investor
- Investor 7%
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+10
- Incentives55
- Confidence70
Veradigm told the SEC that an attacker took credentials from a vendor's environment and used them against a Veradigm API to download patient data including Social Security numbers, while The Gentlemen gang claims 3.5 million records.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+5
- Incentives70
- Confidence60
Astrana Health's SEC filing describes impersonation of its own staff and a spoofed corporate number as the way onto its servers, and says private and confidential data was exfiltrated. No group has claimed it.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+8
- Incentives62
- Confidence52
The medical equipment network says social engineering against a third-party contractor's session opened its cloud patient management and document systems in early June, and the HHS portal now lists 4,115,802 people.
Reality
- Evidence72
- Adoption74
- Hype gap−6
- Incentives55
- Confidence70
The lab says operations continued and no misuse is confirmed. No actor has claimed the theft, so the company's own inventory is the only description of what left the building, and the employee half of it is the reusable kind.
Reality
- Evidence45
- Adoption50
- Hype gap−10
- Incentives65
- Confidence50