Security incident at Fakturownia

Update no. 1 of , 4:00 PM CEST

In brief

  • On 28 September 2026 we established a personal data breach. An unauthorised person gained access to our systems and copied a large part of the database to their own servers. The unauthorised access lasted from approx. 3:20 on 27 September 2026 until approx. 17:45 on 28 September 2026.
  • The incident concerns every account in Fakturownia. The detailed scope of the data taken and the cut-off dates are given below.
  • On 1 October 2026 we started sending individual e-mail notifications – to the owners of all accounts and to the other users of the accounts. Details – in the "E-mail notifications" section.
  • What to do now: set a new password to Fakturownia, enter new API keys in your integrations, and confirm every request for a transfer to a changed bank account by phone, using a number you knew before.

E-mail notifications

On 1 October 2026, from 15:50, we are sending two kinds of message:

  • account owners receive the message "Zawiadomienie o naruszeniu ochrony danych osobowych" (Notification of a personal data breach). It is at the same time a notification of a breach of their data (Article 34 GDPR) and a notification of a breach concerning the data they entrusted to us as controllers (Article 33(2) GDPR);
  • other account users receive the message "Zawiadomienie o naruszeniu ochrony Państwa danych osobowych w Fakturowni" (Notification of a breach of your personal data in Fakturownia), concerning their data as users of the service.

Due to the large number of recipients, sending may take several hours. We send the messages only from the fakturownia.pl domain; they contain no attachments and do not require logging in. In them, we do not ask for passwords, verification codes, BLIK codes or card details. If you do not receive the message, check your spam folder; you will also see the content of the notification after logging in to Fakturownia in the coming days.

In addition, we are launching – in the owners' accounts – a panel in Fakturownia with detailed information: data categories, date ranges and record counts.

What happened?

An unauthorised person gained access to our systems and copied data from the database to their own servers. Type of breach: a breach of data confidentiality (the data were copied). We are analysing the incident together with CERT Polska.

What have we done?

  • 28 September 2026, 13:35 – first block of the attacker's address;
  • 28 September 2026, 18:01 – the attacker's access to the application removed;
  • 28 September 2026, 18:56–20:14 – application keys and service passwords changed;
  • 28 September 2026, 20:44–21:51 – traffic moved to new servers built from scratch, the old ones shut down, the stolen keys deactivated;
  • 28 September 2026, 23:10 – the customer panel temporarily blocked;
  • 28 September 2026, 23:50 – 29 September 2026, 4:03 – customer API tokens replaced; existing API keys work only from the IP addresses previously used by the users of the account;
  • 29 September 2026, 2:35 – additional safeguards on the PDF file generator;
  • 29 September 2026 – the breach reported to the President of the Personal Data Protection Office (UODO), and the incident reported to CERT Polska and to the Police (Central Cybercrime Bureau);
  • 29 September 2026 – the Data Protection Officer informed and the risk to individuals assessed;
  • 1 October 2026 – sending of individual e-mail notifications to account owners and users started.

What data was taken?

For each category we indicate who the data controller is and which period the copying covers. (a) Fakturownia – data of the account and its users, for which Fakturownia is the controller. (b) Customer – data of contractors and other people that the customer entered into the account and entrusted to Fakturownia for processing as their controller.

Category of data Controller What was taken
Company and user data: company name, tax identification number (NIP), address, first and last names, e-mail addresses and phone numbers of users, account identifier (a) Fakturownia in full, where entered
Department data: address, tax identification number (NIP), bank name, account number, IBAN, SWIFT (a) Fakturownia in full, where entered
Hashed user passwords (passwords were not stored in plain text) (a) Fakturownia in full
API tokens, integration keys stored directly in account settings (a) Fakturownia in full – depending on the integrations used
Session identifiers (a) Fakturownia in full
Invoice amounts: net, VAT and gross by rate, currency, amount paid and amount outstanding (a) Fakturownia
(b) Customer		 invoices from the entire period
Bank account balances retrieved through the Bank account connection service (a) Fakturownia in full – only where the integration was active
Contractors: name or first and last name, tax identification number (NIP), address, delivery address, e-mail, phone, bank account number, note, custom fields (b) Customer only contractors added before 16 October 2024
Contractor panel: access link and – if the contractor set a password – the password hash (b) Customer only contractors added before 16 October 2024
Additional invoice parties (e.g. recipient, payer): name or first and last name, tax identification number (NIP), address, e-mail, phone, note; content of additional description fields (e.g. "Notes", "Recipient", custom labels) (b) Customer invoices from the entire period – to the extent the fields were filled in
Full invoice content: seller, buyer, number, dates, amounts, payment method and due date, notes (b) Customer only invoices issued before 22 March 2021
Invoice line items: product names, quantities, prices (b) Customer only invoices from before 6 June 2019
Payments: dates, amounts, transfer titles, names and account numbers of senders (b) Customer to the extent they were entered
Products and price list: names, codes, descriptions, prices (b) Customer in full
Data imported from files (invoices, contractors, products) (b) Customer to the extent they were entered
Content of exports and imports requested in the system (b) Customer requested up to 6 March 2026 – for the most part
Warehouse documents (b) Customer only from before 14 July 2023
Warehouse operations (b) Customer only from before 16 May 2022
Account activity history (a) Fakturownia only from before 24 November 2021
Information about attachments: name, type, size, date (b) Customer only files added before 6 November 2025

We established the cut-off dates from database query logs; they may be off by a dozen or so days. Copying of the largest data sets proceeded from the oldest records and was interrupted before it reached the newer ones. For invoices issued on or after 22 March 2021, neither the buyer name nor the invoice number was taken.

Other account users: their e-mail address and password hash were taken, as well as – where provided – their first and last name, phone number and account identifier.

Approx. 2,250 accounts: from these accounts all data available in the system from the years 2022–2026 were taken, up to a date that differs for each account. The owners of these accounts receive a notification with information specific to their account.

What was not taken, and what are we still establishing?

The following were not taken:

  • KSeF certificates;
  • bank login credentials – Fakturownia does not store them;
  • payment card details – Fakturownia does not store them;
  • the content of invoices issued on or after 22 March 2021 – apart from amounts, additional description fields and data of additional parties;
  • contractor data added on or after 16 October 2024.

To the best of our knowledge, the data covered by the breach have not been made public so far; we are monitoring this together with CERT Polska. We will report new findings on this page and in further e-mail messages.

What do you need to do now?

We describe possible consequences. This does not mean that they have already occurred.

What may happen What we recommend
Messages and phone calls from fraudsters impersonating Fakturownia, a bank, a public authority, a contractor or an employer. They may look credible, because they contain real company, invoice and payment data. Do not open links or attachments in unexpected messages. Do not give out passwords, verification codes, BLIK codes or card details – to anyone. If you get a call "from the bank", "from a public authority" or "from Fakturownia", hang up and call back on the number from the official website. Confirm a request "from your manager" for an urgent transfer through another channel. Forward suspicious text messages to CERT Polska at 8080.
Attempts to take over your Fakturownia account and – if you use the same password – also accounts in other services. Set a new password to Fakturownia. Change the password in other services if it was the same. Check the list of users and the account settings.
Use of stolen keys for integrations with the account. Enter new API keys in your integrations.
Fake invoices, payment demands and requests for a transfer to a changed bank account – sent on behalf of your company or to your company "from a supplier". The fraudsters know the amounts and know which invoices are unpaid. Confirm every request to change a bank account number or any unusual transfer with the contractor using a phone number you knew before – not the number from the suspicious message. Check contractors' bank accounts on the white list of VAT taxpayers and the account numbers on your own invoices in Fakturownia.

If you suspect fraud or an unauthorised transfer, contact your bank immediately. If you suspect a crime, notify the Police and keep the messages and other evidence. Please also inform us of any attempt to use the data covered by the breach.

Information for businesses as data controllers

For the data in group (b) – data of contractors and other people entered into the account – the controller is the customer, and Fakturownia processes them on the customer's instructions (Terms of entrustment of personal data processing). The e-mail message "Zawiadomienie o naruszeniu ochrony danych osobowych" (Notification of a personal data breach), which you will receive shortly, is in this respect a notification of the breach to the controller (Article 33(2) GDPR and §4(8) of the Terms). We are providing information in phases (Article 33(4) GDPR): in the coming days we will make available in your Fakturownia account a panel with detailed information for the account – data categories, date ranges and record counts – which will also make it easier to notify your contractors.

As the controller of these data, you assess the risk and decide whether and how to notify the people concerned. For the data for which Fakturownia is the controller, we assessed the risk as high: the scope of the data is broad and the number of people is very large. This may serve as a reference point for your own assessment. The risks to third parties and the actions you may consider – informing contractors about the risk of impersonation and fake payment demands, changing contractor panel passwords used in other services – are described in e-mail message no. 1.

The 72-hour deadline for notifying the President of UODO runs from the moment the breach is established. According to EDPB Guidelines 9/2022 (point 44), a controller as a rule establishes a breach when the processor informs it. However, if you already had sufficient certainty about the incident earlier (e.g. from our statement of 29 September 2026), the deadline may have started to run earlier. You can submit a preliminary notification on the basis of e-mail message no. 1 and supplement it later.

Contact

We apologise for this situation. We will report further findings on this page – each update will be marked with a number and a date.

Previous versions of the statement

Statement of

We would like to inform you that on 28 September 2026 we detected unauthorised access to the Fakturownia servers. As a result of this incident, an unauthorised person had insight into our users' account data, contractor data and documents generated through Fakturownia.

We understand that such news may be worrying, which is why we want to give you all the information we currently have. We also explain what you can do to further protect your data.

At the same time, we assure you that the incident did not cover data stored within our Integrations and add-ons. This also applies to KSeF certificates – these data were and are safe.

What happened?

An unauthorised person managed to exploit a vulnerability in the system, which resulted in unauthorised access to part of the data.

After detecting the event, we blocked the unauthorised person's access, started rotating keys and passwords and launched new Fakturownia servers. Together with external security specialists, we are continuing to analyse the situation.

At present we know that:

  • the unauthorised access may have covered account data of all Fakturownia users, their contractors and invoices issued in Fakturownia before 2023 – we are establishing the scale of the data leak
  • there was no breach regarding the KSeF integration, other integrations with Fakturownia or payment card data
  • to the best of our knowledge, invoices issued after 2023 were not leaked
  • as a result of the incident, the unauthorised person did not delete any data stored in our systems

What have we done?

  • Immediately after detecting the event, we started work on securing data and access.
  • We are rotating application keys and service passwords.
  • We have launched new application servers and cut off access for unauthorised persons.
  • We have started analysing the incident together with external security specialists and introduced a number of additional safeguards.
  • We have reported the incident to the Police (Central Cybercrime Bureau), CERT Polska and the President of the Personal Data Protection Office

What data may have been compromised?

Our findings so far indicate that the unauthorised person may have had access to the following data:

  • company and user account data, including password hashes
  • session tokens, API tokens and integration tokens generated on the Fakturownia side
  • bank accounts, payment data
  • customers' contractor data (all) and invoice data (in part)
  • application system keys and passwords

If further analysis brings new findings, we will update this statement without delay.

What do we recommend?

To further secure your account, we recommend:

  • changing your Fakturownia account password – learn how to do it
  • changing the password to the e-mail inbox linked to your Fakturownia account and to other services where you use the same password
  • enabling two-step verification – learn how to do it
  • checking your account settings – in particular the bank account number shown on invoices and the list of users who have access to the account

What may the consequences be? Stay alert

It is possible that in the near future you will receive e-mails, text messages or phone calls from people impersonating well-known institutions – a bank, a public authority, a courier company, Fakturownia or your contractors. Such messages often create time pressure and push you to act quickly. Please:

  • be careful with links and attachments in electronic messages
  • do not give out passwords, verification codes, BLIK codes or payment card details – in a message, on a page opened from a link or over the phone. Fakturownia never asks for your password in such cases
  • check the sender's address – we send our messages only from the fakturownia.pl domain; watch out for deceptively similar addresses, e.g. with extra words or typos
  • if you get a call from someone claiming to be a bank or public authority employee – end the call and call the number given on the institution's official website yourself
  • be careful with requests to change a bank account number – it is worth confirming such a change with the contractor by phone, using a number you know
  • report suspicious messages via the contact form (in the "Temat pytania" (Subject) field, please select "Podejrzenie oszustwa" (Suspected fraud)). Suspicious text messages can also be forwarded free of charge to CERT Polska at 8080

Together with CERT Polska and the Central Cybercrime Bureau (CBZC), we are still establishing which customers are affected by the leak. We will notify each of them directly in the near future.

We apologise for this situation. We assure you that the security of your data is our priority, which is why we are investigating the matter with full commitment. We will keep you informed of further findings on this page.

E-mail sent to users

"Notification of a personal data breach" – e-mail of

Dear Sir or Madam,

We regret to inform you that on 28 September 2026 we established a personal data breach in the Fakturownia.pl service ("Fakturownia"). An unauthorised person broke into our systems and copied a large part of the database, including data from your account.

The breach covers:

  • (a) your personal data, for which Fakturownia is the controller – data of the account and its users;
  • (b) personal data of your contractors and other people, which you entrusted to Fakturownia for processing as their controller – including data from invoices, contractors and payments.

In accordance with the Privacy Policy and the Terms of entrustment of personal data processing (the "Terms"), the data under (a) are controlled by Fakturownia. The data under (b), which you entered into the account, are controlled by you, and Fakturownia processes them on your instructions.

As regards the data under (a), this message is the notification referred to in Article 34 GDPR. As regards the data under (b), it is a notification of the breach to the controller under Article 33(2) GDPR and §4(8) of the Terms.

We are providing information in phases (Article 33(4) GDPR). In the coming days, in addition to this notification and given the confidentiality of your clients' data, we will launch in your Fakturownia account a panel with detailed information for your account: data categories, date ranges and record counts. The panel will enable you to notify your contractors of the breach and will make it easier to fulfil your obligations under the GDPR.

What happened?

An unauthorised person gained access to our systems and copied data from the database to their own servers.

  • The unauthorised access lasted from approx. 3:20 on 27 September 2026 until approx. 17:45 on 28 September 2026.
  • We closed the vulnerability on 28 September 2026 at 18:01.
  • Type of breach: a breach of data confidentiality (the data were copied).

What data was taken?

For each category we indicate who the data controller is and which period the copying covers. (a) Fakturownia – data of the account and its users, for which Fakturownia is the controller. (b) Account owner – data of contractors and other people that the customer entered into the account and entrusted to Fakturownia for processing as their controller.

Category of data Controller What was taken
Company and user data: company name, tax identification number (NIP), address, first and last names, e-mail addresses and phone numbers of users, account identifier (a) Fakturownia in full, where entered
Department data: address, tax identification number (NIP), bank name, account number, IBAN, SWIFT (a) Fakturownia in full, where entered
Hashed user passwords (passwords were not stored in plain text) (a) Fakturownia in full
API tokens, integration keys stored directly in account settings (a) Fakturownia in full – depending on the integrations used
Session identifiers (a) Fakturownia in full
Invoice amounts: net, VAT and gross by rate, currency, amount paid and amount outstanding (a) Fakturownia
(b) Account owner		 invoices from the entire period
Bank account balances retrieved through the "Bank account connection" service (a) Fakturownia in full – only where the integration was active
Contractors: name or first and last name, tax identification number (NIP), address, delivery address, e-mail, phone, bank account number, note, custom fields (b) Account owner only contractors added before 16 October 2024
Contractor panel: access link and – if the contractor set a password – the password hash (b) Account owner only contractors added before 16 October 2024
Additional invoice parties (e.g. recipient, payer): name or first and last name, tax identification number (NIP), address, e-mail, phone, note; content of additional description fields (e.g. "Notes", "Recipient", custom labels) (b) Account owner invoices from the entire period – to the extent the fields were filled in
Full invoice content: seller, buyer, number, dates, amounts, payment method and due date, notes (b) Account owner only invoices issued before 22 March 2021
Invoice line items: product names, quantities, prices (b) Account owner only invoices from before 6 June 2019
Payments: dates, amounts, transfer titles, names and account numbers of senders (b) Account owner to the extent they were entered
Products and price list: names, codes, descriptions, prices (b) Account owner in full
Data imported from files (invoices, contractors, products) (b) Account owner to the extent they were entered
Content of exports and imports requested in the system (b) Account owner requested up to 6 March 2026 – for the most part
Warehouse documents (b) Account owner only from before 14 July 2023
Warehouse operations (b) Account owner only from before 16 May 2022
Account activity history (a) Fakturownia only from before 24 November 2021
Information about attachments: name, type, size, date (b) Account owner only files added before 6 November 2025

We established the cut-off dates from database query logs; they may be off by a dozen or so days. Copying of the largest data sets proceeded from the oldest records and was interrupted before it reached the newer ones. For invoices issued on or after 22 March 2021, neither the buyer name nor the invoice number was taken.

What was not taken, and what are we still establishing?

The following were not taken:

  • KSeF certificates;
  • bank login credentials – Fakturownia does not store them;
  • payment card details – Fakturownia does not store them;
  • data stored within the integrations configured in the Integrations and add-ons tab;
  • the content of invoices issued on or after 22 March 2021 – apart from amounts, additional description fields and data of additional parties;
  • contractor data added on or after 16 October 2024.

To the best of our knowledge, the data covered by the breach have not been made public so far; we are monitoring this together with CERT Polska.

Possible consequences and what you can do – your data (point a)

We describe possible consequences. This does not mean that they have already occurred.

What may happen What we recommend
Messages and phone calls from fraudsters impersonating Fakturownia, a bank, a public authority or a contractor. They may look credible, because they contain real data of your company, invoices and payments. Their aim may be to extort money, passwords, authorisation codes or other data. Do not open links or attachments in unexpected messages. Do not give out passwords, verification codes, BLIK codes or card details – neither to us nor to anyone else. If you get a call "from the bank" or "from a public authority", hang up and call back on the number from the official website. Forward suspicious text messages to CERT Polska at 8080.
Attempts to take over your Fakturownia account and – if you use the same password – also accounts in other services. Set a new password to Fakturownia. Change the password in other services if it was the same. Check the list of users and the account settings.
Use of stolen keys for integrations with your account. Enter new API keys in your integrations. For existing API keys, a whitelist based on users' historical IP addresses is maintained.
Fake invoices, payment demands and requests for a transfer to a changed bank account – sent on your behalf or to you "from a supplier". The fraudsters know the amounts and know which invoices are unpaid. Please confirm every request to change a bank account number or to make an unusual transfer with the contractor, using a phone number you knew before. Do not use a number given only in the suspicious message. It is worth checking contractors' bank accounts on the white list of VAT taxpayers. Please also check the account numbers on your invoices in Fakturownia.

If you suspect fraud or an unauthorised transfer, please contact your bank immediately. If you suspect a crime has been committed, notify the Police and keep the messages and other evidence. Please also inform us of any attempt to use the data covered by the breach.

Possible consequences for third parties – entrusted data (point b)

As the controller of these data, you assess the risk and decide whether and how to notify the people concerned. Below we indicate the risks we see and the actions you may consider.

What may happen What you may consider
Messages and phone calls impersonating your company, addressed to contractors, their contact persons and additional invoice parties. Inform your contractors that they may receive messages impersonating your company, and explain how they can verify them.
Fake demands for payment of unpaid invoices to a different bank account. Advise your contractors to confirm every change of a bank account number through an independent channel – e.g. by phone using a number they knew before, not the number from the message.
Use of a copied contractor panel link or of a contractor's password in other services. We are invalidating the links and generating new ones. Contractors who set a password for the panel should be advised to change that password in other services if it was the same.

For the data for which Fakturownia is the controller, we assessed the risk as high: the scope of the data is broad and the number of people is very large. This may serve as a reference point for you when assessing the risk for the data under (b).

The 72-hour deadline for notifying the President of UODO runs from the moment the breach is established. According to EDPB Guidelines 9/2022 (point 44), a controller as a rule establishes a breach when the processor informs it. However, if you already had sufficient certainty about the incident earlier (e.g. from our statement of 29 September 2026), the deadline may have started to run earlier. We recommend recording the date and time of receipt of this message in your breach documentation.

You do not have to wait for the panel with detailed information to be made available in your Fakturownia account: a preliminary notification can be submitted on the basis of this message and supplemented later (Article 33(4) GDPR).

Action we have taken

  • 28 September 2026, 13:35 – first block of the attacker's address;
  • 28 September 2026, 18:01 – the vulnerability in the application closed;
  • 28 September 2026, 18:56–20:14 – application keys and service passwords changed;
  • 28 September 2026, 20:44–21:51 – traffic moved to new servers built from scratch, the old ones shut down, the stolen keys deactivated;
  • 28 September 2026, 23:10 – the customer panel temporarily blocked;
  • 28 September 2026, 23:50 – 29 September 2026, 4:03 – customer API tokens replaced;
  • 29 September 2026, 2:35 – additional safeguards on the PDF file generator;
  • 29 September 2026 – the breach reported to the President of the Personal Data Protection Office, and the incident reported to CERT Polska and to the Police (CBZC);
  • 29 September 2026 – the Data Protection Officer informed and the risk to individuals assessed;
  • 1 October 2026 – sending of individual e-mail notifications to account owners and users started.

What next?

  • In the coming days we will make available in your Fakturownia account information on the scope of the data taken from your account.
  • We publish current findings at fakturownia.pl/incydent (please type the address into your browser yourself).

How to recognise our message?

This message contains no attachments and does not require logging in. We do not ask for passwords, verification codes, BLIK codes or card details. We send messages on this matter only from the fakturownia.pl domain.

More information

Please contact us regarding the incident:

We apologise for this situation.

Yours faithfully,
Fakturownia sp. z o.o.