A serious security incident has occurred in one of Poland’s popular invoicing systems. The invoice broker informed customers that an unauthorized person had hacked into its systems and copied a large portion of its database. The compromised information included company and user data, bank accounts, payment information, API tokens, and some customer and invoice data. The company warns against fraudulent invoices, attempted account number swapping, and phishing attacks.
Invoicing detected unauthorized access to its systems on September 28, 2026. The company initially reported that an unauthorized person had access to user and contractor data, as well as some documents. The company has since provided more detailed information in individual notifications sent to customers.
“An unauthorized person hacked into our systems and copied a large part of the database, including data from your account,” Fakturownia said in a notice sent to one of its customers.
According to the company, unauthorized access continued from September 27th at approximately 3:20 a.m. to September 28th at approximately 5:45 p.m.. The vulnerability was scheduled to be fixed on September 28 at 6:01 PM.
The invoice defines the event as breach of data confidentiality – information was copied by an unauthorized person.
Data on companies, users and bank accounts was leaked
The scope of information intercepted is wide.
According to the Fakturownia notification, the copied data included, among others, company and user names, tax identification numbers, addresses, first and last names, e-mail addresses, telephone numbers and account identifiers.
In the case of data stored in individual departments of the company, the leak could also include bank account numbers, IBAN, SWIFT and bank names.
Encrypted hashes of user passwords were also copied. Fakturownia emphasizes that the passwords themselves were not stored in plain text.
The incident also involved session identifiers and – depending on the configuration of the account – API tokens and integration keys saved directly in settings.
A public statement from Fakturownia confirms that unauthorized access may have involved user account data, contractors, session and API tokens, bank accounts, and payment information.
The attacker could learn invoice amounts and payment information
What is particularly important is that the incident is not limited to basic contact details.
According to the notification, they were copied invoice amounts – net, VAT and gross, currency, amount already paid and amount remaining to be paid. This applies to invoices from the entire period.
If the user used the Invoice connection service with a bank account, the downloads could also be saved in the system bank account balances.
Payment data may also include dates, amounts, transfer titles, and sender names and account numbers – to the extent that such information was available in the system.
It is this range of information that can increase the credibility of future fraud attempts.
A criminal with information about a contractor, the amount owed or an unpaid invoice may try to impersonate a real company and send a false payment request with an altered account number.
The contractors’ data was also included among the copied information.
The problem does not only concern entrepreneurs who have an account with Fakturownia.
The company informed customers that in the case of contractors added before October 16, 2024 The following items could be copied, among others:
company names or first and last names, Tax Identification Numbers, addresses, delivery addresses, e-mail addresses, telephone numbers, bank account numbers, notes and data entered in custom fields.
For older documents, the scope may be even greater.
According to information provided by Fakturownia full text of invoices issued before March 22, 2021 may have been copied. This includes seller and buyer details, document number, dates, amounts, payment method and deadline, and notes.
For invoices issued from March 22, 2021, the company declares that the buyer’s name and invoice number were not collected. However, amounts and information contained in additional fields and on additional pages of the document may have been copied.
Invoicing warns against very credible scams
One of the most serious consequences of the incident may be fraud attempts using real information from the system.
Invoicing warns users about messages and phone calls from people pretending to be bank, office, invoice office or actual contractor.
Such messages can look much more credible than typical phishing because the scammer may have real information about the company, invoices or payments.
The company pays special attention to the possibility of sending false invoices and payment demands as well as requests to make a transfer to a changed bank account number.
Therefore, any unusual message about an account change should be confirmed directly with the contractor, using a previously known telephone number – and not the contact details provided in the suspicious message.
The passwords weren’t written down in plain sight. But they need to be changed.
Invoices reports that the attacker obtained encrypted password hashes, not passwords written in plain text.
Despite this, the company recommends immediate change of password to Fakturownia. If the user has used the same password on other websites, they should change it there as well.
The company also recommends changing the password for the email address associated with the account and enabling two-factor authentication.
Users should also check the list of people who have access to the account and, above all, verify bank account number visible on issued invoices.
KSeF certificates and card data were not leaked
The invoice service also indicates which information has not been collected.
According to the company, the incident did not cover KSeF certificates. Online banking login details were not leaked either, as Fakturownia does not store them, nor were payment card details.
The company also ensures that no data stored as part of the integrations configured in the “Integrations and add-ons” section has been taken over.
The Ministry of Finance also informed that the incident concerning Fakturownia does not mean a breach of the security of data stored in the National e-Invoice System.
The invoice has reported the matter to the Office of Personal Data Protection, CERT Polska and the police.
The company said it reported the breach on September 29. The President of the Personal Data Protection Office, CERT Polska and the Central Bureau for Combating Cybercrime.
According to the chronology presented by the company, the first blocking of the address used by the attacker occurred on September 28 at 1:35 p.m. The vulnerability in the application was closed at 6:01 p.m.
Application keys and service passwords were then changed, traffic was moved to new servers built from scratch, and the old servers were shut down. Client API tokens were also replaced.
According to the current knowledge of Fakturownia, the copied data have not yet been made publicly available. The company declares that it is monitoring the situation together with CERT Polska.
Companies using Fakturownia also have problems.
The incident has another important dimension related to GDPR.
Invoicing is the administrator of data relating to its own users, but in the case of contractor data stored by entrepreneurs in the system, it acts as a processor. The controller of this information remains the account holder.
This means that entrepreneurs using Fakturownia must assess the risk of violating the rights and freedoms of persons whose data was stored in their accounts, and decide whether there is an obligation to report the breach to the President of the Personal Data Protection Office and to inform specific persons.
The Personal Data Protection Office (UODO) reminds in its guidelines on similar incidents at processors that the controller should conduct a risk analysis and, on this basis, determine its obligations under Articles 33 and 34 of the GDPR.
Invoicing has announced the launch of a special panel for customers. It will include the exact scope of data retrieved from a specific account, the number of records, a list of individuals affected by the breach, the proposed risk category, and a draft notification to the President of the Personal Data Protection Office.
The company emphasizes, however, that businesses don’t have to wait for the panel to launch. An initial violation report can be submitted earlier and then supplemented.
Do you use Fakturownia? These are the things you need to be especially careful about right now.
The greatest practical threat following such a leak may not be the disclosure of information itself, but its subsequent use.
Invoice users should change their password, enable two-factor authentication, check which users have access to their account, and verify the account numbers on their invoices.
Special caution is now required when dealing with messages regarding overdue payments, new invoices and requests to change bank account numbers.
The Personal Data Protection Office (UODO) also recommends that people affected by leaks be more cautious about text messages, emails and phone calls that may constitute phishing or an attempt to obtain further information.
In the case of Fakturownia, the risk is particularly significant because the intercepted information may allow criminals to create messages containing real company, contractor, account or payment details.
Source: Fakturownia.pl, UODO
© Nowiny Wschodnie. Publication and distribution of this material is permitted only with attribution to the author and an active link to the original article.
Journalist and Editor-in-Chief of Nowiny Wschodnie, a news platform followed by more than 140,000 people on social media. A graduate in Journalism and Social Communication, he has been co-creating and developing Nowiny Wschodnie since 2017. He gained professional experience working with local and international media.
He specializes in fact-checking, countering disinformation and propaganda, and information security. His work focuses on Poland, Ukraine, Eastern Europe, and Polish-Ukrainian relations. He is also the founder of a non-profit organization working in the fields of integration and intercultural dialogue.
What do you think about this story?
Join the conversation. Please keep comments relevant to the article.
Write a comment