Fakturownia Data Breach: What We Know One Week Later and What Your Company Must Do Now

The Fakturownia data breach is one of the largest security incidents on the Polish internet this year. The invoicing platform, which serves more than 600,000 customers, has confirmed that an attacker gained access to its servers. A week has passed. Here is what we know so far and what your company should do now.

What happened

According to the company, as reported by CyberDefence24, the intrusion lasted from September 27 (around 3:20 a.m.) to September 28 (around 5:45 p.m.). The attacker found a vulnerability in the invoice templates and then a flaw in the library that generates PDF files. That gave them the keys the platform uses to sign user sessions. The breach came to light on September 29, when the attacker, who goes by “Fingerprint,” contacted the media directly.

What data was exposed

Based on statements from the company and press reports, the following data is at risk:

• email addresses, first and last names, phone numbers, and account IDs,
• password hashes (salted),
• client and vendor details, and bank account numbers,
• invoices. This is roughly 6 TB of documents, and for about 2,250 accounts the attacker downloaded all available data from 2022–2026.

Data from the National e-Invoicing System (KSeF) was not exposed, as confirmed by Poland’s Ministry of Finance, and neither was payment card data. CERT Polska and the Central Cybercrime Bureau (CBZC) are investigating. The breach also affected VosFactures, a French service that ran on Fakturownia’s technical infrastructure.

What your company must do

1. Change your Fakturownia password and the password for the email account linked to it, especially if you have used that password anywhere else.
2. Turn on two-factor authentication and review your account settings, particularly the bank account numbers shown on your invoices.
3. Assess whether you must notify the Personal Data Protection Office (UODO). Fakturownia processed data on your behalf, so you, as the controller of your clients’ and vendors’ personal data, are responsible for assessing the risk. The GDPR gives you 72 hours from becoming aware of a breach to report it. On October 3–4, the forms on the biznes.gov.pl portal were intermittently unavailable. If you could not submit your notification, keep evidence of your attempts.
4. Warn your accounting team about fraud. Real invoices and genuine client data are ideal material for swapping a bank account number in a “corrected invoice” or in a message that appears to come “from a supplier.” Verify every change of bank details by phone, using a number you already had on file.

SecurHUB’s take

This incident is a textbook example of supply chain risk: your company’s data was leaked even though no one attacked your own systems. NIS2 and the new National Cybersecurity System Act (KSC) require organizations to assess the security of their service providers. In practice, that means knowing who you entrust your data to, having a data processing agreement in place with them, and having a plan for the day they fall victim to an attack.

We can help you assess the breach and prepare your notification to UODO. Contact us.

Sources: CyberDefence24, dobreprogramy, RMF24, dlahandlu.pl