Oreaxe may earn a commission if you buy through links on this page. How we make money.
Polish online invoicing service Fakturownia says an attacker copied a large part of its database after breaking into its servers on September 27 and 28, 2026. The Fakturownia data breach touches a platform that, according to The Record, serves more than 600,000 businesses.
The stolen data goes well beyond email addresses. Fakturownia’s official incident notice lists bank account numbers, API tokens and integration keys, password hashes, customer details and older invoices, which is exactly the material fraudsters need to send convincing fake payment requests.
| What happened | An attacker exploited a vulnerability, accessed Fakturownia’s servers and copied a large part of its database |
| Who’s affected | Fakturownia account holders and the customers and suppliers recorded in their accounts, mainly in Poland |
| Severity | High: bank details, API keys and invoice data enable targeted payment fraud |
| Status | Access blocked on September 28, keys rotated, authorities notified; investigation ongoing |
| What to do now | Reset your password, replace API keys in third-party integrations, turn on 2FA and verify any bank account change by phone |
What happened
Fakturownia says it detected the intrusion on September 28 and that the unauthorized access ran from early on September 27 until the evening of September 28. Starting that afternoon and into the next morning, it blocked the attacker, revoked the attacker’s application access, rotated keys and service passwords, moved traffic to new servers and temporarily locked the customer panel, according to its incident timeline.
The company reported the Fakturownia data breach to Poland’s data protection authority (UODO), CERT Polska and the Central Cybercrime Bureau. An actor calling itself “Fingerprint” has claimed to hold 6 terabytes of invoices, a figure that Sekurak reported as the attacker’s claim and that has not been independently confirmed.
Poland’s Finance Ministry said its review found no breach of KSeF, the national e-invoicing system that Fakturownia connects to, The Record reports. Digital Affairs Minister Krzysztof Gawkowski said those responsible are being pursued.
How the Fakturownia data breach happened
Fakturownia’s official notice says only that the attacker exploited a system vulnerability. Polish security outlet Niebezpiecznik, relaying answers from the company’s CTO, describes more: a flaw in invoice templates, then a weakness in the PDF generation library, which gave the attacker the key used to sign user sessions; knowing that key then let them reach the server. Portal Faktura.pl relays the attacker’s own, unconfirmed account of a blind SQL injection, so the full root cause is not settled. Its timeline of the Fakturownia data breach does list hardening the PDF generator among its first fixes.
A stolen session signing key matters because it can let an attacker forge valid logins without knowing anyone’s password. Once that key and the server itself are exposed, patching the original bug is not enough, which is consistent with Fakturownia rotating its keys and moving to new servers.
The notice says passwords were stored only as hashes, not in plain text, but warns that a simple password can still be reconstructed from its hash. For most accounts the exposure has date limits: full invoice content from before March 22, 2021, and invoice amounts (net, VAT and gross) from all periods. About 2,250 accounts, though, had all of their 2022 to 2026 data taken, up to a cutoff date that varies by account. KSeF certificates, bank login credentials and card data were not affected, according to the company.
Why it matters for small businesses
An invoicing database is a fraudster’s address book. It shows who pays whom, how much, how often and into which account. With that, a criminal can email one of your customers a perfectly plausible invoice that differs from the real thing only in the bank account number.
After the Fakturownia data breach, the company itself warns users to expect impersonation of the company, banks and authorities, fake invoices built from real financial data, and requests to change account numbers. For businesses in Poland and elsewhere in the EU, there is also a GDPR question: if your customers’ or suppliers’ personal data sat in your account, you may need to assess whether the Fakturownia data breach must be reported, and Niebezpiecznik points to the 72-hour notification window under Article 33.
What to do now
- Set a new Fakturownia password, and change it anywhere else you reused it. Turn on two-factor authentication if it is not already active.
- Generate new API keys and enter them in every third-party integration, such as your online shop or accounting tools, as the company instructs. Integrations built by Fakturownia itself need no change. Then check the user list and account settings for anything you did not add.
- Check the bank account number printed on your invoice templates. Make sure nobody has swapped it.
- Tell your team and your regular customers that any request to change bank details must be confirmed by phone, using a number you already had, before money moves. Fakturownia gives the same advice.
- Treat unexpected emails, texts and calls that mention your invoices as suspect, even when they quote real amounts. Do not share passwords, verification codes, BLIK codes or card details.
- Reused passwords are what turn one breach into several. A password manager makes unique passwords painless; Proton Pass is one option (our review), and our comparison of password managers for small teams covers alternatives.
Oreaxe’s take
Small businesses tend to judge a SaaS tool on price and convenience, but invoicing and accounting platforms hold the data that criminals monetize fastest. When you choose one, it is fair to ask how it stores API keys, whether it supports two-factor authentication, and how it would tell you about a breach.
Our view is that the bank-detail check is the single most valuable step here. Password resets limit what the stolen hashes are worth; a callback rule for payment changes stops the fraud that follows, whichever supplier gets breached next.
If your business takes card payments as well, the same discipline appears in PCI DSS. Our guide to PCI DSS 4.0.1 authentication requirements explains what assessors expect for passwords and MFA.
Sources
- Fakturownia: Incydent, oficjalny komunikat (September 29, 2026, updated October 1, 2026)
- The Record: Cyberattack on major Polish invoicing platform exposes customer data (October 1, 2026)
- Niebezpiecznik: Fakturownia.pl zhackowana (September 29, 2026, updated October 2, 2026)
- Portal Faktura.pl: Cyberatak na Fakturownia.pl, firma potwierdza wyciek danych (September 30, 2026)
- Sekurak: Wg relacji wyciekło właśnie 6TB danych z Fakturowni (September 29, 2026)
Every factual claim links to its source. Spotted an error? Tell us.