We Don't Give a Shit About Cybersecurity

Will this ever end?

No.

And I'm not saying that to sound menacing at the top of the article. I'm saying it because I know why it won't end. We don't give a shit about cybersecurity. Deeply, sincerely and absolutely couldn't-care-less.

Book, e-book, audiobook and video course on pre-sale: You're not a target. You're an opportunity. But before you buy it - read this post to the end and see just how much this problem affects us. Cybersecurity is not a job for IT.

"Don't worry, it'll get flagged and nobody will ever see it"

I see it every day. In conversations with friends, with employees, with business owners. And it always looks the same.

When we talk about security, everyone nods with a serious face. "Yes, Kamil, it's really important. And so trendy right now. You hear about it everywhere."

But when it comes to a decision — staff training, an audit, cleaning up access rights — suddenly it's "not now". Because right now there are more important things to deal with. Rolling out AI. Sales. Clients. And the company party, because you've got to show off.

I speak a lot and I talk a lot about security. The room is cheerful — people laugh, nod, get the point and see how important it is. After the talk they come up, thank me, say they "have to sort this out back home". And then, after a few weeks or months, a message arrives: "Kamil, remember how we laughed at your talk? Well, now it's not so funny. It happened."

And every time I feel like replying the same thing: prevention beats cure. Except by then it's already too late for prevention.

There are also — thankfully, only occasionally — messages from very dishonest players I don't work with. They ask whether the training could be done… with a backdated date. So the authorities look more kindly on them ;-)

Yes. Seriously. And that says it all. Nobody here is thinking about your data. It's all about covering their own backside. And besides — it won't change a thing. It already happened. Your data has already leaked, and no date on an invoice will undo that.

Security in Poland is like inspecting your electrical wiring. By law you have to do it every five years, but who cares — the lights are on, the sockets work, and an electrician costs money. Until one day something sparks in the junction box behind the cabinet. And then suddenly everyone is amazed that "it always worked before".

And don't think it's only companies

It's easy now to nod along and grumble about the CEOs. Except that we, ordinary people, couldn't care less in exactly the same way. Maybe even more.

The same password for email, Facebook and the shoe shop. Two-factor authentication? "Ugh, that's too much clicking." A phone update? "Remind me tomorrow" — for the last eight months. PESEL national ID left unlocked, because "who would take out a loan in my name". A BLIK payment code dictated to a "cousin" on Messenger, because he wrote that it was urgent.

And our data? We hand it out ourselves, willingly and with a smile. Another discount-store app, another loyalty card, another "agree to everything" clicked without reading — because the butter will be 50 cents cheaper. Location? Go ahead. Access to contacts? Sure. Five years of purchase history? Take it, don't be shy. And then great surprise that some company knows where we live, what we eat, when we get home from work and what our lover's name is.

For fifty cents. That's what our privacy is worth.

And here's the uncomfortable truth: criminals don't need to break into companies to make money at all. Most often they come straight to us. In 2025 CERT Polska logged over 260,000 incidents, and 97% of them were scams — phishing, fake shops, "your bank's consultant". Not attacks on server rooms, but prising passwords and money out of ordinary people.

Why? Because it's easier. A company at least has some sort of admin, some sort of firewall and one training session every three years. You have a phone, a hurry and trust in a text saying a parcel is waiting for a €0.50 top-up. Why break down the bank's door when the customer will carry the money out to the car park himself?

And once you add in all the corporate leaks I'll get to in a moment, the fraudster has the full set: your name, PESEL, address and phone number from one leak — and your gullibility at the other end of the line.

Everyone does it. And nothing happened.

It's like this practically everywhere. Customer data flying around on private laptops. Scans of contracts circulating on WhatsApp. And this isn't my conspiracy theory — Poland's data protection authority (UODO) described exactly such a case: sales reps working on sales for Energa-Obrót spent many months dropping scans and photos of clients' contracts into group chats on WhatsApp. On private phones. Next to barbecue photos and memes.

And now I'll ask you one question. Just answer honestly, to yourself, nobody's watching.

You don't do that?

Because maybe you're thinking: "Well, we don't have that kind of nonsense here." Really? Nobody on your team has a little WhatsApp group where a photo of an invoice flies in, a scan of a contract, a list of clients with phone numbers? Nobody has sent themselves a file with data to their private email, "to finish it at home"? And you don't discuss patients on the "hospital" group?

I know how it is. Because you tell me yourselves. In private messages, after trainings, over a beer: "Kamil, the company didn't give us a work phone or any messenger, so what am I supposed to do? I'm hammering away on my private WhatsApp."

And I get it. The boss wants results yesterday, the client wants an answer right now, and the only tool you have on hand is your own phone. So you do the job with what you've got.

But now listen to how this story ends. Because it always ends the same way.

Something will go wrong. The phone will get lost on the tram. Someone will hijack your WhatsApp account. A screenshot from the group will end up where it shouldn't. And then the company — which for two years watched you do this every single day and was very pleased that "you communicate so efficiently" — suddenly gets amnesia. "That is not our tool. We did not authorise it. The employee acted on their own." And for dessert it'll wave a legal clause at you for exfiltrating company data.

And you're left alone with it. You, your private phone and a letter from a lawyer.

Look, by the way, at the Energa-Obrót case I linked a moment ago — one of the parties, during the proceedings, tried to play down its role and shift the blame onto others. Exactly that scenario. In black and white, in UODO's statement.

"But everyone does it!"

Well then listen: if everyone started shitting in the street, would you squat by the kerb too? "Everyone does it" is not an argument. It's a description of what rock bottom looks like — shared, cosy and stinking.

And there's always that second bonus: "…and nothing bad happened." Well, it didn't. For now. And then we get a data leak — and it's no longer "everyone" explaining it to the boss, just you.

And on the other side, when you're the customer? Companies still ask you to email a scan of your ID card. Just like that. "Please send a photo of both sides of your ID." Sure, and why not your card PIN and the entry-door code while we're at it?

And now the second question. Honest, too.

Have you ever wondered what happens to your data when you're the one on the other side?

You go to the doctor and talk about things your closest family doesn't even know. You go to court because you're getting divorced, and you lay your whole marriage, finances and fights over the kids on the table. You take your child to a psychologist because something's wrong. You write to the form tutor in the school e-register that your kid has problems at home.

This is the most confidential information you have at all. And now guess who processes it.

Exactly the same people as in the previous paragraph. The receptionist whose clinic never gave her a decent system. The assistant in the law firm who'll "send it faster on WhatsApp". The secretary who takes a photo of a counselling report to forward it to the headteacher. The same people, with the same "everyone does it", with the same private phone in which your diagnosis sits between a photo of the cat and a recipe for stew.

No encryption, no control, no protection whatsoever. And without your knowledge.

So before you next drop a scan of a client's contract into a group chat — think about the fact that somewhere in another group chat, someone is dropping in yours.

A leak day after day

And don't think this is theory. EnelMed. MyDR. Medyc, Fakturownia, FELG. Hospitals, schools, hotels. You've barely had time to forget one leak and there's already another. And that's the best case, because the text telling you your data has leaked doesn't have to come at all. In Poland we have a leak day after day, and we've got used to it like to the weather forecast. If you want to see how long that list is, take a look at zabezpieczsie.pl/cyberataki. Trust me, the scrolling takes a while.

And the best part is how we find out about these leaks. Take MyDR. The leak was in August 2026. We weren't told about it by the clinics that used the system. We were told by government systems. Over a month has passed, and many people still haven't received any notification. No email, no text, nothing. So if you're treated at a clinic that used MyDR and nobody wrote to you — it doesn't mean your data wasn't there. It means nobody bothered to tell you.

And this isn't an exception. I recently talked to a colleague who works on a similar medical system. They had a leak too. I asked how the clients reacted — meaning the facilities that are obliged to inform patients. The answer: 85% couldn't be bothered. Eighty-five percent. Not "didn't have time", not "still analysing". Couldn't be bothered.

And as I write this, yet another leak comes in. Fakturownia: account data, contractors, invoices, bank account numbers. According to the media it was done by the same "Fingerprint" who earlier exfiltrated patient data from MyDR and Medyc. One person (or one group) and three Polish companies.

And you know what pisses me off most about it? People had been reporting security bugs to Fakturownia since 2016. I did it myself in 2023–2024, not as a hacker in a hoodie, but as a customer who noticed that something was off. Ten years of reports. And what? Well, exactly. "Don't worry, it'll get flagged."

How did I find out about the leak? Not from Fakturownia, but from social media, from people who do security for a living. The company did, admittedly, post a statement on its website. But tell me honestly: when did you last visit the website of your invoicing software to check whether your data had leaked? Well, exactly.

A statement on a subpage nobody reads is not informing your clients — it's ticking a box. And the GDPR says plainly: if a leak carries a high risk, you have to notify the affected people without undue delay. An email to every client is a few clicks.

And so it goes round. A leak, a statement nobody reads, a week of chatter, and silence. Next one.

Fines? What fines?

You could say now: fine, but there's the GDPR, there's the regulator, there are fines. The entrepreneur will get scared and start caring.

Well, no. Fines are no stick for entrepreneurs, because very few incidents end in a fine at all. I talked about this with Michał Starczewski — how to avoid a fine from the regulator and why procedures are the key. Worth watching, because it shows nicely how it looks behind the scenes.

And when a fine does land, look at this WhatsApp case. Many months of clients' contract scans on private phones, communication partly outside the European Economic Area, attempts to shift the blame onto others. The result? Reprimands and a fine for one of the parties of… PLN 10,145. That's what keeping clients' data in a messenger costs in Poland. Less than a company party, for which the money can always be found.

"Covering it up ends in a loss of trust". Bullshit.

Deputy PM and Minister of Digital Affairs Krzysztof Gawkowski said recently:

"Companies hiding attacks is the biggest mistake, because they always put citizens at risk."

And he added that trying to protect your reputation by concealing incidents ends for companies in an even greater loss of trust.

With the first part I agree one hundred percent. With the second — well, sorry, but that's bullshit.

A loss of trust? You still buy from the online shop that had a leak. You still use the medical lab, because you don't have much choice about where to get your tests done. I'll go further: you don't even have any say in whether the clinic you're treated at uses the system that had the data leak or some other one that hasn't leaked yet. You don't know that. You probably didn't even know until now that such a thing exists. And when you get a text about a leak, you wonder — what's this about? You don't understand it. Nobody tells you. So how are you supposed to lose trust in something you have no idea even exists?

And here's the whole calculation companies make cold-bloodedly: we don't pay fines, or we pay symbolic ones, clients stay because they have no alternative, and in a year everyone will forget anyway. Ignoring security pays off. It's not a bug in the system. It is the system.

They say a Pole is wise after the event. Except that Kochanowski, over four hundred years ago, already had his doubts about that:

But if the truth should gore us here as well,
A Pole will buy himself a brand-new saw:
That he's a fool before the harm — and after.

A leak, a text with an apology, a week of outrage, and then everything as before. Jan of Czarnolas never knew WhatsApp, yet he described us flawlessly.

Audits? There are some. And better not read them before bed.

Alright, so maybe at least the state looks after the most important ones? Power, water, the railways?

The Supreme Audit Office (NIK) checked. It audited eight operators of essential services — those who supply energy and drinking water and provide rail and water transport. The result was a disaster. I took that report apart piece by piece in a video about the damning NIK report, so here just the short version.

And this is happening at a time when an incident occurs in Poland on average every two minutes, and we're among the most frequently attacked countries in the world. The audit's verdict? The safeguards at all eight operators were insufficient. None ensured the resilience of the systems the essential service runs on. Six out of eight systematically ignored critical alerts, and some had no monitoring at all, so they might not even have known someone was sitting inside their network. And the ministers who were supposed to keep an eye on them knew about it and did nothing.

It's as if a fire alarm were wailing in a power plant, the security guard put on headphones to finish his series, and his boss decided it wasn't his shift.

If that's what the security of power and water looks like, are you really surprised that your blood test results leaked from the lab?

So what do we do about it?

First of all: stop not giving a damn. Seriously. Because it concerns you far more than you think. This is not a problem for "companies", "IT people" or "the GDPR lot". It's your test results, your divorce, your child at the psychologist's and your PESEL in the hands of someone who is right now looking for a sucker. To a criminal you're not "just an average Joe with nothing interesting". You're an opportunity. I wrote a whole book about it, by the way — "You're an Opportunity" — and if I had to sum it up in one sentence, it would be: there's no such thing as someone "too small to rob" ;-)

Fines won't fix it. You've already seen what they look like: rare, late and for ten thousand zlotys, i.e. cheaper than a company party. And even if they were ten times higher, there are simply too many of these cases. The regulator has no chance of handling all the WhatsApps, all the ID scans in emails and all the USB sticks left on trains. It probably can't cope already today. No one is going to come and do it for us.

So one thing remains. Start building digital awareness and stop pretending the problem doesn't exist. At home, at work, in the family, at your child's school. Not as punishment and not because it's "trendy", but because otherwise we'll end up like Estonia in 2007. A country that was Europe's digital star pupil vanished from the net in a few days — banks, cards, government offices and media stopped working, and people stood in front of ATMs with a full account and an empty wallet. I describe that story in the book, because it's the best proof that digital life can grind to a halt overnight.

You don't have to become a hacker. It's enough to stop being an easy target. And that starts with knowledge.

Time to get educated. Before you're the one who gets the email "we are informing you of a security incident". Although… you probably already have.