Autopay provides online payment services for e-commerce businesses and automatic toll payments for motorways in Poland. In a statement published on 13 November 2026, the company said that on 11 November it found unauthorised access to its infrastructure and to a portion of payment data it processes.
Date | Event |
|---|---|
11 November 2026 | Autopay detects unauthorised access to infrastructure and part of its payment data |
13 November 2026 | Autopay publicly confirms the incident and reports it to UODO (Poland's data protection authority), KNF (the financial supervisor) and the police |
14 November 2026 | Coverage continues, with reports based on the company's statement and on Sekurak, a Polish security publication |
The company says it blocked the unauthorised access, secured its systems and added monitoring. It has not described the method of intrusion.
What is still unknown
The statement is deliberately cautious. Autopay says it has not confirmed that data was copied or used, but it "cannot completely exclude" that this happened, so it is contacting customers whose data may be involved.
Several questions remain open: how many customers may be affected, which types of data were exposed (for example, card data, personal details or transaction records), and whether any data has been published or offered for sale. None of these has been answered publicly at the time of writing.
Why the uncertainty matters
Payment operators sit between businesses and their customers' money, so the consequences of a breach can spread quickly. Even when no card numbers are stolen, transaction records and personal details can be used for convincing fraud, such as messages that look like they come from a bank or a merchant.
Autopay's own advice reflects this. It recommends that customers check their transaction history regularly and report any unfamiliar payment to their bank promptly. It also warns about messages and phone calls that refer to the incident, because criminals often exploit news like this to target people.
What customers should do
Check your bank statements for transactions you do not recognise, especially small test payments, which are sometimes used to confirm that a stolen card works.
Report unfamiliar transactions to your bank immediately. Banks can block cards and reverse payments more easily when they hear about them quickly.
Ignore unexpected messages about Autopay. Do not click links or share codes in messages or calls claiming to be from Autopay, a bank or a government body. Contact the company or your bank through the number on their official website or the card.
Consider changing passwords for accounts linked to the same email address, particularly if you have reused passwords.
Watch for official updates from Autopay, UODO and your bank. Be cautious about information that does not come from these sources.
What businesses using Autopay should do
Merchants that use Autopay for online payments should check whether the company has contacted them directly, review their integration logs for unusual activity, and be ready to answer customer questions about the incident. Clear, factual communication with customers will limit confusion and reduce the chance that criminal messages are mistaken for official ones.
Businesses should also review how much payment-related data they store themselves, since a provider breach is less damaging when a merchant holds less customer information.
The lesson
The most important detail in this case is the time gap between the detection and the announcement. The company says it found the intrusion on 11 November and disclosed it two days later. The difference between these dates is normal in many incidents, while the company works out what happened. But it means customers depend on the company's word about what is safe until more facts emerge.
For customers, the practical lesson is that a payment provider's breach is not only the provider's problem. Regularly reviewing transactions and knowing how to report suspicious payments remains the most reliable protection.
