Poland Will Publicly Name and Shame Companies with Poor Cybersecurity, Says Minister Gawkowski

Poland’s Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski has announced a change in how the government deals with corporate cybersecurity. Until now, the government has mostly paid for security improvements and issued recommendations. From now on, it plans to publicly name companies that have failed to secure their systems. He made the announcement on October 7 at the Cyber24 Days conference.

“We will point fingers”

“From now on, we will help you, but we will point fingers at the companies that failed to protect themselves,” Gawkowski said. According to the minister, the old approach did not work because many Polish companies simply neglected to invest in their own security.

The new approach will include:

• telling the media and the public who is responsible for specific incidents,
• warning about attacks by showing how poorly protected entire industries are, from sports and agriculture to government service providers and the healthcare sector,
• putting the focus on the accountability of owners, management boards and supervisory boards,
• continued financial support, but for investments made before an attack, not after one.

Extra scrutiny for the energy sector

Minister of Energy Miłosz Motyka announced that energy companies, both state-owned and private, must go through a “full professionalization” of their cybersecurity and present plans for developing it. The two ministries want to work together to set aside money in the 2026–2027 budgets for improving security in the energy sector.

The stakes are high. By some estimates, a single day of nationwide power outage would cost the Polish economy at least PLN 40 billion. This comes against the backdrop of coordinated attacks on Poland’s energy sector in December 2025.

Why now: a string of breaches exposing Poles’ data

The announcement follows a series of major data breaches at Polish companies, especially in healthcare:

• MyDr (an electronic medical records system): the breach may affect as many as 18.8 million people and more than 12,000 healthcare facilities. The exposed data includes national ID numbers (PESEL), contact details, prescriptions and health information. The minister called it one of the largest incidents of its kind in the country’s history.
• Medyc: the attackers claim to have data on about 5 million people.
• IQ Dental and FELG (software for dental practices), Wakacje.pl (passport data) and Legimi.

Anyone who wants to check whether their data was leaked can use the government website bezpiecznedane.gov.pl. It is also a good idea to freeze your PESEL number in the mObywatel app.

What this means for your company

For many organizations, being publicly named as responsible for a breach costs more than a fine: customers leave, contracts are lost, and banks and insurers start asking questions. On top of that come the obligations under the NIS2 Directive, which explicitly makes the management board responsible for cybersecurity (we covered this in our NIS2 guide).

Three things to do first:

1. Find out where your customer data is stored and which vendors have access to it. Most of this year’s breaches started with a software or service provider.
2. Commission an independent security audit and draw up a remediation plan with deadlines. That document also serves as evidence of due diligence if an incident happens.
3. Prepare an incident response plan that sets out who makes the decisions, who has to be notified, and how quickly (see our article on the incident response plan).

SecurHUB’s take

The government’s change in tone sends a clear message: cybersecurity is no longer just an IT issue. It is now the board’s responsibility, and boards will be held accountable for it, including in public. We help companies get ready before an incident happens, with services ranging from NIS2 and ISO 27001 compliance audits and penetration testing to 24/7 SOC monitoring.

Sources: WNP.pl, Spider’s Web, XYZ.pl, Portal Faktura.pl (MyDr)