Beyond Fakturownia. Other cyberattack announcements

Fakturownia is one of several organizations whose security incidents were reported in late September 2026. Announcements and reports also concerned enel-med, the State University of Applied Sciences in Suwałki (PUZ), Zdrowit S.A. and patient data from an addiction treatment unit in Inowrocław. They describe different consequences: access to data, encrypted systems and the theft of an archive.

The publication dates are not the dates of all the attacks. The Inowrocław case goes back to August, while the date of the incident at Zdrowit has not been given. For a customer, the key questions concern the data affected and the next recommendations. For a business, system access, the ability to restore operations and contact with the provider are equally relevant. Below, we compare the findings available on September 30, 2026.

When were the incidents disclosed and detected?

Fakturownia and business data

Enel-med and patient data

The university in Suwałki loses access to its systems

What did Zdrowit confirm?

The August theft of data concerning Inowrocław

What should customers and businesses check?

When reading an announcement, distinguish the date of the incident, its detection and the publication of information. The known dates in this comparison are listed below. All dates in the table refer to 2026.

In its announcement of September 29, Fakturownia said that it had detected unauthorized access to its servers the previous day. The potentially affected information includes company and user account data, password hashes, session, API and integration tokens generated by Fakturownia, bank account numbers and payment data. The operator also lists counterparty data and some invoice data.

This concerns sign-in credentials, connections between applications and transaction information. We describe specific actions for users in Fakturownia data breach - what to do?. Here, Fakturownia serves as a reference point for incidents in other sectors.

In its announcement of September 27, enel-med said that it had identified a cyberattack and access to some patient data on September 24. According to the company, the breach may affect around 3% of its entire database. This is a preliminary estimate while the investigation continues; the announcement gives neither the number of people nor a detailed list of affected data fields.

The operator said it would contact each patient whose data had been affected individually, providing information and recommendations. It also stated that all its facilities were operating normally and that appointments could be booked through the application and call center.

For patients, these are two separate pieces of information. Appointments going ahead concern access to treatment. A breach notification concerns data confidentiality. Being able to book an appointment does not replace the promised information about an individual's situation.

The Prof. Edward F. Szczepanik State University of Applied Sciences in Suwałki published an announcement on September 29. It reported a ransomware attack, which uses software to demand a ransom, and the encryption of its server infrastructure. It lost access to its systems and their backups, including student and employee databases, student administration systems, and HR and payroll systems.

The university warned of a high risk of unauthorized access to personal data. It listed first and last names, PESEL numbers (Polish national identification numbers), addresses, grades and bank account numbers, among other information.

Despite these problems, PUZ said that the academic year would start on October 1 and classes would follow their schedules. For other organizations, this is a concrete reason to check whether systems can be restored and how staff will receive information if the usual tools stop working.

On September 24, CyberDefence24 published a statement from Zdrowit S.A., which Alert Medyczny subsequently covered. The company confirmed unauthorized access to IT systems and the encryption of some resources. CyberDefence24 also reported that a ransomware group had already listed Zdrowit among its victims in early September. The date of the attack itself remains unspecified.

The company explicitly distinguished its systems from those of Apteki Zdrowit pharmacies. According to its statement, the pharmacies are separate entities using dedicated specialist software that was not affected by the incident. Keep that scope in mind when assessing the consequences for your own pharmacy or order. A shared name alone does not establish which systems were attacked.

In its notification concerning the Medyc data breach, the addiction and psychiatric treatment center in Inowrocław reported a cyberattack on the system of its data processor: Qbusoft, the developer of the Medyc software. CyberDefence24 also reported on the case on September 24. The Medyc section of the notification concerns patients of the day addiction treatment unit.

According to the notification, the encrypted database archive was stolen on August 22 and 23, and the incident was detected during the night of September 8 to 9. The scope covers patients of the day treatment unit from July 1, 2024, to August 23, 2026. The center states that the extraction of first names, last names, PESEL numbers, residential or temporary addresses, phone numbers and email addresses was conclusively proven.

The center states that first names, last names and PESEL numbers were stored in encrypted form, but the provider instructed recipients to assume that they were easy to decrypt and that attackers had obtained them in plaintext. The notification also describes scripts targeting tables containing medical data and an assessment that the theft of hospital discharge summaries is very likely. This is the provider's assessment as reported by the center.

In its announcement updated on September 28 at 08:26, Medyc confirms the theft of personal data and lists the same categories of identifying and contact information. It also states that the theft of medical records had not been confirmed at that stage. The center's notification and Medyc's announcement agree on the theft of personal data; the assessment of the risk of discharge summaries being obtained must be distinguished from confirmation of the theft of medical records.

This case illustrates the software provider's role in the overall data processing chain. An organization needs information about more than its own computers; it also needs to know about the systems in which its service provider stores or processes data.

As a customer, patient or student, follow the organization's official announcement and notifications addressed to you. Check which group of people, period and types of data the information concerns. Verify urgent requests to sign in, provide information or make a payment using a phone number or website address you already know.

Enel-med recommends unique passwords, two-factor authentication and caution with emails, text messages and calls. Enel-med and PUZ also recommend using Poland's procedure to block the use of your PESEL number. These actions help reduce further risks; changing a password does not remove data someone has already copied.

Within your business, establish who receives provider announcements and makes decisions about access. Check whether the data you need can be restored, when this was last tested and how you will contact your team without the main system. Distinguish the end of an operational interruption from determining what information may have been taken.

An access review should also cover unused integrations. If you use KSeFGPT, the guide to deleting an integration explains how to remove its configuration and saved credentials from the application. This requires the appropriate permissions and the Automation module. Revoking a token with its issuer is a separate operation.

Someone who reads documents for accounting and an employee who handles sales may need different levels of access. When organizing business accounts, start with the tasks people perform, then check each person's permissions.

In a KSeFGPT organization, an authorized user can configure groups and assign them to active members. The guide to setting group permissions and assigning a group to a user describes this process in the context of the selected company. Review these settings when an employee's responsibilities change.

Further guidance on the incident and reviewing access:

Fakturownia data breach - what to do?

How to set group permissions and assign a group to a user in KSeFGPT

How to delete an integration in KSeFGPT

How to give an accountant access to KSeF invoices