Government announces public naming of companies responsible for data leaks
After a series of data leaks involving Poles, the state is changing its approach to companies that neglect cybersecurity. Legal and reputational risk is growing for management boards and supervisory boards.
The announcement was made at the Cyber24 Days conference, which took place on 7 and 8 October at PGE Narodowy in Warsaw. Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski said that the previous strategy based on subsidies had not worked. “We are changing the doctrine from asking to ordering, checking and auditing,” he said, as quoted by Interia. The ministry also wants to inform the public which companies are responsible for incidents.
The backdrop is the leaks from recent weeks. The largest concerned the MyDr system for medical facilities. According to CyberDefence24, it affected the data of as many as 18.8 million people from more than 12 thousand facilities, including information about appointments, prescriptions and health status. UODO (Personal Data Protection Office) is conducting an inspection at the company, and the penalty may reach 20 million euros. On 29 September, wakacje.pl was hacked, leaking, among other things, customers’ addresses, dates of birth and passport data. Spider's Web also lists attacks on Medyc and Legimi (183 authors), while Interia mentions Enel-Med, the FELG system for dentists and Fakturownia.
Gawkowski stressed that cybersecurity is the “responsibility of owners, management boards and supervisory boards,” and not only of the IT department. Since 3 April, the new Act on the National Cybersecurity System (KSC), implementing the EU NIS2 directive, has been in force. The deadline for entry into the KSC register passed on 3 October. Failure to register carries a penalty of from PLN 15,000 to 10 million euros, and the act also introduces personal liability for the head of the entity.
Jakub Bojanowski, an expert in cybersecurity and IT audit and a member of the Association of Independent Members of Supervisory Boards, points to IT suppliers. In the case of MyDr, the obligations towards patients fell on the clinics, because they are the data controllers. As the expert quoted by “My Company Polska” says, data processing can be outsourced, “but responsibility for it cannot be got rid of in the same way”.
Bojanowski advises that the supervisory board should ask the management board how long the company can last without the supplier’s system, when the response to an attack was last practised, and how to run the business during a crisis. For companies processing customer data, this means checking contracts with suppliers and actual readiness for an incident, not just documentation.