Lisbon, May 26, 2026 (Lusa) - Portugal’s National Data Protection Commission has received hundreds of reports of unauthorised access to health data since Thursday, reporting the possible commission of criminal offences to the public prosecutor's office and launching an investigation.

Over the last six days, since 21 May, the commission has received hundreds of reports of unauthorised access to health data from across Portugal, said the commission’s chair, Paula Meira Lourenço, in comments to Lusa, declining to comment further as the investigation is currently ongoing.

The Criminal Investigation Police announced on Friday that it had opened an investigation into the case of unauthorised access to records of Portugal’s state health service (SNS) users, including children, following suspicions that a third party had used a doctor’s credentials at the Alto Minho local health centre.

The commission emphasised that health data is classified as special category data under the General Data Protection Regulation (GDPR), therefore benefiting from enhanced protection, given the high risks associated with their processing.

Minors are particularly vulnerable and are also subject to special protection under European and national legislation, Paula Meira Lourenço said.

Unauthorised access to SNS user data through a doctor’s compromised credentials affected at least 100,000 people, compromising the personal data of children and adults, the police said.

VP/MYAL // ADB.

Lusa