Breaches and incidentsBriefReported by a reputable outlet, citing the company
FELG Dent (Polish dental practice software, about 16,000 practices): about 2 million patient records exposed, IDOR claimed
FELG Software confirmed an incident and gave a preliminary estimate of about 2 million patient records (attackers claim 2.4 million).
- Disclosed
What happened
- FELG Software confirmed an incident and gave a preliminary estimate of about 2 million patient records (attackers claim 2.4 million); potentially affected data includes names, PESEL numbers, addresses, medical data and e-prescription, e-sick-leave (e-ZLA) and eWUS eligibility information (Alert Medyczny, citing Sekurak).
- Root cause: the attackers (“Horus”) claim they used an Insecure Direct Object Reference: from a demo account they reached production data by changing resource identifiers. FELG says it identified the cause but has not released technical detail.
- Attacker: “Horus” (self-described), demanding a ransom not to publish.
- Response: prosecutor and UODO notified, forensics, per-practice breach reports and a patient notification tool for clinics.
Sources
- https://alertmedyczny.pl/cyberatak-na-felg-dent-incydent-moze-dotyczyc-okolo-2-mln-rekordow-pacjentow/
- https://konbriefing.com/en-topics/cyber-attacks.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.