The President of the Polish data protection authority (UODO) has requested the intervention of the Prosecutor General to resume an investigation into a data breach from the Chinese sales platform pandabuy.com, after the case was closed by the prosecutor's office.

The case began on March 31, 2024, with the online disclosure of personal data of 1,300,000 customers of the platform, including several tens of thousands of Poles. The compromised information included names, email addresses, phone numbers, user IDs, IP addresses, passwords, delivery addresses as well as order and payment data. These data were then used to publish an interactive map on the site "lista-drillowcow.pl", displaying the names and delivery addresses of Polish customers. On April 29, 2024, the UODO reported to the Warsaw-Śródmieście district prosecutor's office a suspicion of criminal offense for illegal data processing, under Article 107, paragraph 1, of the Personal Data Protection Act. After an initial refusal to investigate was overturned by the district court, the prosecutor's office finally closed the investigation on September 25, 2025, a decision confirmed on appeal on March 13, 2026.

In his request to the Prosecutor General, the President of the UODO argues that the investigation was incomplete and that the evidence was not thoroughly examined. He believes that essential actions were not taken, including identifying the administrators of the internet domains concerned, requesting hosting providers to obtain information, clarifying the channels through which the data were obtained, conducting a technical analysis to identify the perpetrators, and hearing the injured parties. The supervisory authority considers that the closure of the case is a wrong decision, made on procedural grounds without substantive examination, and emphasizes that it is in the public interest to pursue those responsible for the illegal processing of Polish citizens' data.