Every Account, No Exceptions: What the Fakturownia Breach Means for the Businesses That Used It

On 28 September 2026, Fakturownia.pl experienced a personal data breach. An unauthorised person had accessed its systems and copied a large part of the database to their own servers.

The access window, according to the company's own reconstruction, ran from approximately 03:20 on 27 September until approximately 17:45 on 28 September. The vulnerability was closed at 18:01 that day.

The company's assessment is unambiguous: "The incident concerns every account in Fakturownia."

What makes this case unusually instructive is the quality of the disclosure. Fakturownia published a detailed, category-by-category breakdown of what was taken, with cut-off dates for each data type, an hour-by-hour log of its response, and an explicit discussion of the GDPR obligations now sitting with its customers. That level of candour is rare, and it is what allows the rest of this article to be specific rather than speculative.

For Polish businesses, the practical consequence is this: if you issued invoices through Fakturownia, your contractors' data was processed under your control, which means you have your own notification obligations, separate from the ones Fakturownia has already discharged.

What happened

Response timeline

Fakturownia published its own log, which is worth reproducing because the speed of containment is one of the few positives here.

What was taken

The company's breakdown separates data by controller. Category (a) is data Fakturownia controls. Category (b) is data customers entered and entrusted to Fakturownia as processor.

Taken in full, or in full where entered:

• Company and user data: company name, NIP, address, names, email addresses, phone numbers, account identifier

• Department data: address, NIP, bank name, account number, IBAN, SWIFT

• Hashed user passwords (passwords were not stored in plain text)

• API tokens and integration keys stored in account settings

• Session identifiers

• Invoice amounts for the entire period: net, VAT, gross by rate, currency, amount paid, amount outstanding

• Bank account balances, where the account connection integration was active

• Products and price list

Taken only up to a cut-off date:

Fakturownia explains the pattern: copying of the largest data sets proceeded from the oldest records and was interrupted before reaching newer ones. The cut-off dates were established from database query logs and may be off by a dozen or so days.

The exception that matters

Buried in the statement is a detail that undercuts the reassurance the cut-off dates otherwise provide.

For approximately 2,250 accounts, all data available in the system from 2022 to 2026 were taken, up to a date that differs for each account. The owners of those accounts receive a notification containing information specific to them.

If you run a business on Fakturownia, the cut-off dates above are only meaningful once you have confirmed you are not one of those 2,250.

What was not taken

• KSeF certificates

• Bank login credentials, which Fakturownia does not store

• Payment card details, which Fakturownia does not store

• Content of invoices issued on or after 22 March 2021, apart from amounts, additional description fields and additional parties

• Contractor data added on or after 16 October 2024

For invoices issued on or after 22 March 2021, neither the buyer name nor the invoice number was taken.

How the attacker got in

Fakturownia's first statement described exploitation of a vulnerability in the system. In answers published by Niebezpiecznik, the company's technical director described vulnerabilities connected to invoice templates and PDF generation, through which the attacker obtained the session signing key.

That detail explains the response log. Additional safeguards were applied to the PDF generator at 02:35 on 29 September, and session identifiers appear in the list of stolen data.

Attribution

The person or group using the alias "Fingerprint" contacted Zaufana Trzecia Strona, claimed to have taken 6 TB of invoices, and provided screenshots indicating access to Fakturownia's data. The same alias is linked to earlier breaches at the Polish medical platforms MyDr and Medyc.

Several caveats belong with that. The 6 TB figure is the attacker's own claim and has not been confirmed. Fakturownia has not publicly attributed the incident. And according to reporting in Rzeczpospolita, Fingerprint claims not to intend to sell the data, says the aim was to draw attention to security problems, offers to help the affected companies, and exchanges messages with CERT Polska, while investigators suspect a Polish national.

None of that reduces the risk to anyone whose data was copied. A stated intention is not a control. The data exists on someone else's servers, and intentions can change, be abandoned, or be overtaken by a further compromise of the attacker's own infrastructure.

As of Fakturownia's statement, the data had not been made public, and the company is monitoring this together with CERT Polska.

Why it matters

This is invoice fraud fuel, precisely targeted. The attacker holds company names, NIP numbers, bank account numbers, invoice amounts, and crucially which invoices are paid and which are outstanding. A fraudulent payment demand built on that data does not look like a scam. It looks like an overdue invoice you recognise, from a supplier you use, for an amount you owe.

Every customer inherited a legal obligation. Fakturownia controls account data. The customer controls contractor data entered into the account. Fakturownia has notified UODO for its own breach, but that filing covers its own obligation only. Each business using the platform must assess the risk to its contractors' data and decide independently whether to notify.

The 72-hour clock may already have started. Fakturownia points to EDPB Guidelines 9/2022, under which a controller generally establishes a breach when the processor informs it, which for most customers means the email of 1 October. The company also notes that if a customer had sufficient certainty earlier, from the 29 September statement for example, the deadline may have begun running then.

Stolen session identifiers and API tokens are live access, not just data. Fakturownia rotated tokens and restricted existing API keys to previously used IP addresses, which is a strong mitigation. Integrations that were not updated remain a loose end.

It is the third Polish SaaS provider hit by the same alias. UODO has spoken of the data of 19 million Poles in connection with MyDr, and up to 5 million in connection with Medyc. Software suppliers are the efficient target: one intrusion reaches every customer at once.

Who is affected

• Every Fakturownia account, according to the company's own statement.

• Approximately 2,250 accounts with a far wider scope, covering all system data from 2022 to 2026.

• Contractors of Fakturownia customers, whose names, NIP numbers, addresses, emails, phone numbers and bank account numbers were entered into accounts before 16 October 2024.

• Accounting offices using the platform on behalf of clients, who are likely to be controllers for multiple third-party data sets simultaneously.

• Other account users beyond the owner, whose email address and password hash were taken, along with name, phone number and account identifier where provided.

What to do now

Immediately, as a Fakturownia user

1. Set a new Fakturownia password, and change it anywhere else the same password was used.

2. Enable two-step verification.

3. Enter new API keys in your integrations. Existing keys are restricted to previously used IP addresses, but replacement is the clean fix.

4. Check the account settings, particularly the bank account number displayed on your invoices, and review the list of users with access.

Against the fraud that follows

5. Confirm every request to change a bank account number by phone, using a number you knew before, never the number in the message. This is the single most important behavioural control, because the attacker knows your real amounts and outstanding invoices.

6. Check contractors' bank accounts on the white list of VAT taxpayers.

7. Expect convincing impersonation of Fakturownia, banks, public authorities, contractors and employers. Fakturownia states it sends messages on this matter only from the fakturownia.pl domain, with no attachments, and never asks for passwords, verification codes, BLIK codes or card details.

8. Forward suspicious text messages to CERT Polska on 8080.

9. If a suspicious transfer has already gone out, contact your bank immediately, then the police, and preserve the messages as evidence.

Your own GDPR obligations as a controller

10. Record the date and time you received Fakturownia's notification. That timestamp anchors your 72-hour deadline.

11. Assess the risk to your contractors' data yourself. Fakturownia assessed the risk to the data it controls as high, given the breadth of data and the number of people, and offers that as a reference point rather than a substitute for your own assessment.

12. Do not assume Fakturownia's UODO filing covers you. It covers Fakturownia.

13. You can file a preliminary notification now and supplement it later, under Article 33(4) GDPR, without waiting for the detailed panel Fakturownia is adding to accounts.

14. Consider informing your contractors directly, especially about the risk of impersonation and fake payment demands, and advise contractor panel users to change that password anywhere else they reused it.

Final thoughts

The attacker did not need the invoices to be recent to make them dangerous. Knowing a company's bank account, its contractor list and the exact amount outstanding on an invoice is enough to construct a payment demand that survives scrutiny. This is why the cut-off dates, reassuring as they look, matter less than they appear. Old invoice data plus current contact details is a working fraud kit.

The lesson: when a SaaS provider is breached, the obligation does not stay with the provider. Thousands of Polish businesses woke up to discover they were data controllers for information they had never thought of as theirs to protect, with a clock already running. Most will not have a breach register, a risk assessment template, or a clear sense of which of their contractors need telling.

The second lesson is for anyone evaluating software suppliers. Fakturownia's disclosure is, by any reasonable standard, better than most: fast containment, detailed scope, named cut-off dates, honest uncertainty about those dates, and explicit guidance on customers' own legal position. That transparency is what makes informed action possible. It is worth asking prospective suppliers what they would publish in the same situation, because the answer tells you what your own response would look like.

Two things worth doing this week: confirm whether your account is among the 2,250 with the wider scope, and check the bank account number currently printed on your invoices.