Dom Development Data Breach: How Buying a Home Put Families' Identities at Risk

Introduction: From Dream Home to Digital Nightmare

Buying a home is one of the biggest moments in anyone's life. It brings excitement, plans for the future and a sense of security. Few people at that point are thinking about servers, databases or cybersecurity. Yet, as the incident at Dom Development, one of Poland's largest residential developers, has shown, those two worlds are closely linked. The cyberattack, which the company said it detected on December 4, 2025, is more than a corporate problem. It is a personal threat to thousands of customers, employees and business partners who never expected their digital identity to be at stake when they bought an apartment. The breach exposes an uncomfortable truth: our private lives are tied much more closely than we think to the companies we trust. In this analysis, we look at the most alarming parts of the incident and explain how to protect yourself from its fallout.

Dom Development S.A. is a leading Polish residential developer. It has been in the construction market since 1996 and is headquartered in Warsaw. It is one of the largest companies in its sector in Poland and builds and sells apartments in both the mainstream and premium segments. Dom Development operates in Poland's key cities. It runs projects in Warsaw and, through its subsidiaries, in the Tricity area (via Euro Styl S.A.), Wrocław (e.g. Dom Development Wrocław Sp. z o.o.) and Kraków (e.g. Dom Development Kraków Sp. z o.o.). Dom Development S.A. has been listed on the Warsaw Stock Exchange (GPW) since 2006.

1. The Biggest Shock: Your Children's Data Leaked Along With Yours

When we hear about a data breach, we instinctively think about our own exposure: my bank account, my PESEL number (Poland's national identification number), my email address. The Dom Development incident breaks that pattern. Its most disturbing feature is that the data at risk goes beyond people directly connected to the company. It also covers their family members, including minors. That is a new and far more personal level of threat.

According to the company, the attackers may have stolen highly sensitive data on the families of employees and contractors. The scope of that information is staggering:

• Employees' children: Full names, dates of birth, PESEL numbers and home addresses.
• Other family members and partners: Full name, date of birth, PESEL number and their relationship to the employee.

What does this mean in practice? Child identity theft is especially insidious and dangerous. A child's PESEL number is "clean": it has no credit history and no debts. For fraudsters, it is the perfect tool for taking out long-term loans or setting up shell companies. Worse still, this kind of fraud can go unnoticed for years, and the consequences can be devastating. Imagine a young person who, on reaching adulthood, discovers they cannot get a student loan, open their first credit card or even pass an employment background check because their identity was ruined long ago. The scope of the adult data that fell into the wrong hands was just as alarming.

2. An "Identity Theft Kit": What Exactly Leaked?

A list of the stolen data alone does not capture how serious this is. Taken together, the pieces form what could be called a complete "digital identity theft kit." In criminals' hands, it can do far more than secure a quick payday loan. Let's look at exactly what may have been stolen, because it goes well beyond the usual information.

Customers and Business Partners:

For people who bought an apartment, negotiated a contract or worked with the developer, this data is enough to build a full financial, property and even personal profile.

• Personal data: First and last name, PESEL number, ID card number and series, parents' first names, marital status.
• Financial data: Bank account number, amount of debt, information on transactions, financing and payments.
• Property data: Land and mortgage register number, property addresses and even details of co-ownership (joint marital property or separation of property).
• Contact and digital data: Home and registered address, email address, phone number, IP address.
• Sensitive and behavioral data: Information on purchasing preferences and, most shockingly, the notice states that the dataset may also have included health data.

Employees and B2B Contractors:

Staff data is just as sensitive. It reveals not only a person's entire career path but also the most private areas of their life.

• Identification data: First and last name, PESEL number, tax identification number (NIP), ID card number and series along with the photo, student ID numbers.
• Employment data: Full employment and education history, training records, professional licenses and use of benefits (including participation in Employee Capital Plans (PPK) and the Company Social Benefits Fund (ZFŚS)).
• Financial data: Salary, bank account number, information on bonuses, deductions, tax reliefs and even wage garnishments by bailiffs.
• Benefits data: Most worrying of all, the breach may have included information on the employee's regional branch of the National Health Fund (NFZ) as well as child support payments.

With a dataset this complete, a single person could take over almost the victim's entire digital life: taking on debt in their name, impersonating them with government agencies and hijacking their online accounts.

3. The Domino Effect: One Attack, an Entire Corporate Group at Risk

Complex corporate structures mean we often don't realize how interconnected different companies are. The Dom Development attack is a clear illustration of how an incident at one company can cascade through an entire ecosystem of related businesses. That is an important lesson for consumers and investors alike.

According to the official notice, the cyberattack affected the entire Dom Development Group. This means data processed by many different entities is at risk, including:

• Dom Development S.A.
• Dom Development Wrocław Sp. z o.o.
• Dom Development Kraków Sp. z o.o.
• Dom Development Kredyty Sp. z o.o.
• Dom Construction Sp. z o.o.
• Dom Development Grunty Sp. z o.o.
• Dom Land Sp. z o.o.
• Fundacja Nasz Dom
• Euro Styl S.A.

Why does this matter? A customer who dealt only with Dom Development Kredyty may have assumed their data was processed there and nowhere else. In reality, their information sat within a broader IT infrastructure that became the target of the attack. This kind of domino effect is often the result of shared IT infrastructure, centralized databases or group-wide data processing agreements. A single weak point can compromise the security of the whole group.

4. Your Digital First Aid Kit: What to Do Right Now

The situation is serious, but people affected by the breach are not defenseless. The key is to act immediately and deliberately to reduce the risk. Below is an action plan based on the company's own recommendations and cybersecurity best practices.

1. Freeze your PESEL number immediately. This is the top priority. The service is free in the mObywatel government app. Freezing your PESEL number makes it much harder for fraudsters to take out credit or loans, or sign contracts, in your name.
2. Turn on two-factor authentication (2FA). Make sure 2FA is enabled on all your key online accounts, especially your primary email inbox. That inbox is the gateway to password resets for other services, so securing it is critical.
3. Consider replacing your ID card. If you have good reason to believe your data, including your ID card number and series, has been stolen, that is sufficient grounds to apply for a new document.
4. Monitor your credit activity. Create an account with the Credit Information Bureau (BIK) and turn on alerts. You will be notified of every attempt to take out credit in your name, so you can respond quickly.
5. Be (even more) suspicious. Stay extra vigilant in the coming months. Don't click suspicious links, don't open attachments from unexpected emails, and verify the identity of anyone who calls asking for your data. Remember that fraudsters can use stolen information to make their phishing attempts more convincing.

These steps are no longer extraordinary precautions. They are the foundation of basic digital hygiene today.

Conclusion: A Lesson We Didn't Want, but Have to Learn

The Dom Development breach is a powerful reminder of a few painful truths. First, our data reaches much further than we think. It covers our finances, our property and, most worryingly, our entire families. Second, even the biggest market players, the ones we trust with such sensitive information when we buy a home, can fall victim to an attack.

This incident is a bitter lesson about the price we pay for digital convenience. The question remains: are we, as a society, ready to treat our personal data as seriously as the keys to our own home?

Aleksander

Sources:

• Official security notice on the Dom Development S.A. website
• Dom Development Group statement on the cyberattack (Bankier.pl)

FAQ

How do I know if my data was exposed in this incident?

Dom Development has committed to notifying people whose data may have been compromised directly. If you were a customer, employee or business partner of any company in the group, you should receive an official notification. You can also contact the developer directly or check the notices in the privacy policy section of its website.

What should I do first after learning about the breach?

Freeze your PESEL number in the mObywatel app right away (the service is free). It is the single most important step to stop anyone from taking on financial obligations in your name. Next, turn on two-factor authentication (2FA) on all your key accounts, especially your primary email inbox, and create an account with the Credit Information Bureau (BIK) with alerts turned on.

Can I claim compensation from Dom Development?

Yes. Under the GDPR (Article 82), you have the right to compensation for material and non-material damage resulting from a personal data breach. To pursue a claim successfully, you must show that you suffered actual harm (e.g. identity theft or financial loss) and that the breach caused that harm. It is worth consulting a lawyer who specializes in data protection.