NFZ data leak: data of 11 million people ended up with outsiders; the fund advises blocking PESEL

The National Health Fund (NFZ) reported a leak of data on about 11.1 million people: outsiders obtained first names, surnames, PESEL numbers and information on entitlement to state-funded treatment. The fund warns of the risk of identity theft and advises people to block (zastrzec) their PESEL. According to NFZ, the leak contains no diagnoses or medical history.

The data were downloaded on 18–21 and 26–27 March 2024. According to prosecutors in Poznań, the perpetrators gained access to accounts of medical facility staff on the MyDr platform and used a script to send more than 18 million queries to the eWUŚ system. NFZ stresses that its own protection was not breached.

The report appears now because on 5 October prosecutors sent an indictment against five people to court. CERT Polska experts remind that leaked data can be used even years later.