Exactly, also phone numbers are coupled with national ID and medical IT systems are leaky and outsourced into oblivion. In that case they didn't provide alternative to send link over email. Later on test results with full personal info can be acquired in darknet and Russian speaking internet [1]. Are there any consequences? The authorities advice to "be careful" and the service provider says "they're sorry".

[1] - https://www.gov.pl/web/baza-wiedzy/hakerzy-ujawnili-kolejna-...