Fakturownia invoicing platform server breach

On 29 September 2026, Fakturownia, one of Poland's most widely used online invoicing platforms with more than 600,000 business customers, disclosed that an attacker had gained unauthorized access to its servers. The company's incident notice says the access lasted from about 03:20 on 27 September until 28 September, when the intrusion was detected, the attacker's IP was blocked and the service was moved to newly built servers.

Fakturownia said the attacker copied extensive customer data, so the breach may concern account data of all users. The exposed material includes account details, password hashes, API tokens, contractor (counterparty) records added before October 2024, payment records and bank account information, and invoice data; full invoice contents dating from before March 2021 were taken, with partial exposure of newer invoices.

Response

The company reported the incident to Poland's data protection authority (UODO), CERT Polska and the Central Bureau for Combating Cybercrime (CBZC). It told customers it would invalidate all API tokens on 1 October 2026 and recommended resetting passwords, regenerating API keys and confirming any request to change bank account details by phone. Poland's Minister of Digital Affairs publicly promised that those responsible would face severe consequences.

Why it matters

Invoicing platforms hold both a company's own data and that of every business it trades with, including bank account numbers. Stolen invoices and counterparty records are ideal material for invoice fraud and business email compromise, in which criminals send convincing requests to change payment details, which is why the company stressed telephone verification of bank account changes.