What do we know about the personal data leak affecting millions of Poles?
In recent days a huge database of personal data has appeared online, containing detailed information about nearly half of Poland's population. The scale of this incident is unprecedented and it is one of the largest personal data breaches in our country's history. The leak covers not only PESEL numbers, but also full names, home addresses, ID card numbers and parents' names.
At present, the source of the leak remains unknown. The cybersecurity services and the Personal Data Protection Office (UODO) are conducting intensive investigations. Investigators are analysing several scenarios - from a security breach at one of the large financial institutions to a fault in the systems of an external company processing data on behalf of the public sector.
The case is still developing, and the state authorities have announced further statements in the near future. Regardless of how the leak occurred, its consequences may affect millions of citizens. That is why it is worth taking concrete protective steps now and learning your rights in this situation.
What risks does the leak of a PESEL number and personal data bring?
Criminals who have such a complete set of personal information gain the tools to carry out many types of fraud. This is not merely a theoretical threat - identity theft is one of the fastest-growing crimes in Poland, and leaks of this kind dramatically increase its scale. The consequences for victims can be disastrous and can drag on for years.
The most serious risks associated with the data leak include:
- Fraudulent loans and credit - criminals can take out financial commitments with non-bank lenders and credit institutions using stolen personal data.
- Impersonating the victim - registering telecommunications services, opening bank accounts or entering into contracts in someone else's name.
- Tax fraud - filing false tax returns in order to obtain an undue tax refund.
- Fraud in dealings with public authorities - using other people's data in correspondence with public institutions.
- Phishing and social engineering - using the victim's genuine data to make fraudulent phone calls or emails appear credible.
Banking specialists stress that you should not delay preventive action. The sooner we take protective steps, the lower the risk that our data will be used unlawfully. Older people, who are often the main target of telephone fraudsters, should be particularly vigilant.
How to protect yourself effectively after a data leak? A practical guide
The most effective and most urgent step every citizen should take is to restrict your PESEL number immediately. Since November 2023, Polish law has required banks and other institutions to check, before granting a loan or entering into a financial commitment, whether the PESEL number has been restricted. This is a real barrier for criminals.
Restricting your PESEL number step by step
Restricting your PESEL can be done in two ways. The first is to use the mObywatel app - simply log in with your trusted profile and select the option to restrict your PESEL number. The second is the gov.pl portal, where the procedure is just as simple and intuitive. The restriction is free of charge and immediate, and if necessary - for example when taking out a loan of your own - it can be lifted temporarily.
Additional protective measures
In addition to restricting your PESEL, it is worth considering further protective measures. Activating notifications with the Credit Information Bureau (BIK) lets you receive alerts every time anyone checks your credit history. This is an early warning that someone may be trying to take out a loan using your data. The BIK Alerts service costs only a few dozen zloty a year, and its value in the context of the current threat is invaluable.
You should also be extra vigilant when taking phone calls from people claiming to be bank, public office or police staff. A genuine bank employee will never ask for your full login details, SMS codes or one-time passwords. If you have any doubts, hang up and call the institution's official helpline yourself.
Legal aspects - liability for the leak and the rights of those affected
From a legal perspective, a personal data leak on such a massive scale has serious consequences for the entity responsible for the breach. The GDPR provides for administrative fines of up to €20 million or 4% of annual global turnover of the business - whichever is higher. The Personal Data Protection Office is obliged to conduct proceedings and establish whether the data controller fulfilled its data protection obligations.
Every person whose data was disclosed as a result of the leak has the right to take certain legal steps. First of all, they have the right to information - the data controller is obliged to notify the affected persons of the breach without undue delay if it may result in a high risk to their rights and freedoms. In addition, those affected may seek compensation for material and non-material damage through the civil courts.
It is worth emphasising that Article 107 of the Personal Data Protection Act provides for criminal liability for the unlawful processing of personal data. Persons who made the database available online face up to three years' imprisonment. If identity theft has occurred, the perpetrators are liable under Article 190a § 2 of the Criminal Code, which provides for imprisonment from 6 months to 8 years.
What to do if your data has been used by fraudsters?
If you suspect that your data from the leak has already been used without authorisation, immediate action is essential. Here are the steps you should take first:
- File a report of a suspected criminal offence at your nearest police station or with the prosecutor's office - this is the foundation of any further legal action.
- Report the breach to UODO - a complaint can be filed electronically via the ePUAP platform or in writing.
- Check your credit history with BIK - make sure no commitments have been taken out using your data.
- Contact a law firm specialising in personal data protection - a professional representative will help you pursue compensation claims and safeguard your interests.
- Regularly monitor your bank accounts and statements - react immediately to any unauthorised transactions.
Remember that, as a person affected, you are entitled to compensation for the infringement of personal rights under Articles 23 and 24 of the Civil Code. Courts in Poland are increasingly awarding financial compensation to victims of data leaks, which confirms a growing awareness of how serious such breaches are.
Do not wait - secure your rights today
The leak of the personal data of millions of Poles is a situation that demands a decisive response. Restricting your PESEL number and monitoring with BIK are the absolute minimum that everyone should do without delay. However, if your data has already been used or you want to fully safeguard your legal interests, professional legal help is essential.
Our firm has many years of experience in matters concerning personal data protection, identity theft and pursuing GDPR claims. We help clients at every stage - from securing evidence, through reports to law enforcement authorities and UODO, to representation in court in compensation cases.
Contact us today to arrange a consultation and find out what legal steps you can take in connection with the leak of your personal data. Do not let criminals use your data with impunity - the law is on your side.
Have a question about this?
The first consultation is free - let us talk about your situation.
