Polish Invoicing Platform Fakturownia Suffers Data Breach, Exposing Customer Data

Data Breach at Fakturownia

Fakturownia, a prominent online invoicing platform in Poland serving over 600,000 businesses, announced a data breach earlier this week. An unidentified attacker exploited a system vulnerability to gain unauthorized access to the company's servers. The full extent of affected customers is still being determined.

Compromised Information

Potentially compromised data includes user and company account information, password hashes, bank account details, authentication and integration tokens, and data belonging to customers and business partners. Invoices issued through Fakturownia before 2023 may also have been accessed. Payment card data and information from company integrations were not affected.

KSeF Integration and Official Response

The breach has drawn attention due to Fakturownia's integration with the National e-Invoicing System (KSeF), a platform operated by Poland’s tax administration. Poland's Finance Ministry confirmed that a review found no breach of KSeF's security or data. Fakturownia also stated that digital certificates for KSeF access remained secure. Polish Digital Affairs Minister Krzysztof Gawkowski confirmed authorities are investigating the incident.

Incident Response and Investigation

Fakturownia detected the unauthorized access on Monday, blocked the attacker, and initiated password and application key rotations. New servers were brought online, and the company is collaborating with external cybersecurity specialists. The breach has been reported to Polish cybersecurity and data protection authorities.

Attacker Claims

A cybersecurity publication reported that an attacker named "Fingerprint" claimed responsibility, providing purported evidence of access to Fakturownia's infrastructure, including screenshots and database dumps. The attacker claimed to have stolen 6 terabytes of invoices, though this claim and the scope of the material have not been independently verified.