If your company uses or has ever used Fakturownia.pl, this incident affects you directly. The company says the attack covered every account, and part of the copied data belongs to your customers, for whom you are the data controller. That means legal obligations on your side, not just a password change.
What happened and how long the access lasted
An unauthorised person had access to Fakturownia's systems from 27 September 2026 (around 3:20) to 28 September (around 17:45). According to the company's CTO, the attacker exploited a flaw in invoice templates, then a vulnerability in a PDF generation library, and obtained the session signing key, which gave access to the server. The hole was closed on 28 September at 18:01 and customer API tokens were replaced overnight. On 29 September the company reported the breach to UODO (the Polish data protection authority), CERT Polska and the police (CBZC), and since 1 October it has been emailing account owners and users. The service has over 600,000 customers in Poland and abroad.
The company says that, to its knowledge, the data has not been published. The attacker claimed to have copied 6 TB of invoices; this is unconfirmed, and log analysis points to a smaller scope.
What data leaked
The first group is data Fakturownia controls itself, covering all accounts:
- company and user details: name, tax ID (NIP), address, names, emails, phone numbers;
- bank account numbers of departments (with IBAN and SWIFT);
- password hashes (salted, not plain text), session IDs;
- API keys and integration keys stored in account settings.
The second group is data about your customers and documents, for which you are the controller:
- customers added before 16 October 2024;
- full invoice content from before 22 March 2021, invoice line items from before 6 June 2019;
- invoice amounts (net, VAT, gross) from the whole period, payment data, product catalogue, part of the warehouse data.
About 2,250 accounts created in 2022–2026 lost a wider set of data; their owners receive separate information. According to the company, KSeF certificates, bank login credentials, card data and data from the "Integrations and add-ons" section were not taken. The Ministry of Finance confirmed the incident does not involve data in KSeF, the national e-invoicing system.
Former customers are in the dataset too
The leak mainly covered the oldest records, so companies that stopped using Fakturownia long ago cannot assume they are unaffected. GreenWay Polska, an EV charging operator, left the service at the end of 2023, yet on 9 October it notified customers from 2018–2023 that their names, addresses, emails, phone numbers and invoice data had leaked.
What to do if your company uses Fakturownia
- Set a new Fakturownia password and change it wherever you used the same or a similar one, especially for email. A simple password can be recovered from its hash.
- Enable two-step verification and log out all sessions.
- Generate new API keys for integrations (shop, accounting, CRM) and revoke the old ones on the integration provider's side.
- Check the bank account numbers on your invoice templates and the list of users with access to the account.
- Adopt a rule: every request to change an account number or make an urgent transfer is confirmed by phone, using a number you already knew. Larger transfers are approved by a second person.
The most likely consequence of the leak is invoice fraud. A criminal who knows your customers, amounts and payment dates can send a convincing message about a "new account number". Warn accounting and key partners. Suspicious text messages can be forwarded free of charge to 8080 (CERT Polska).
The duty to notify UODO within 72 hours
For your customers' data, your company is the controller under the GDPR. You must still make your own risk assessment. The 72-hour deadline runs from the moment you learned of the breach; the company usually points to the email of 1 October, or earlier if you saw the notice of 29 September. You can file a preliminary notification and complete it later; Fakturownia provides a partly pre-filled template.
Not every breach has to be reported. Business data that is public in CEIDG usually means low risk, but the decision must be documented. If invoices contained PESEL numbers (Polish national ID), private bank account numbers or health information, the risk is high and those people must also be notified directly. People whose PESEL may have leaked should be advised to block (zastrzec) their PESEL number in the mObywatel app.
The lesson for other companies
Customer data lives at SaaS providers longer than the contract does. When you leave a service, demand deletion of your data and written confirmation, and keep a list of all processors, including former ones, in your record of processing activities. Treat API keys like passwords: with limited permissions and a procedure for quick rotation.