Fakturownia has confirmed a cyberattack and a leak involving some of its data. The incident was reported to CERT Polska, and authorities are investigating its exact circumstances. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski said the perpetrators are being pursued. The company says data connected with KSeF integration and payment card details were not affected.
On 29 September, Polish cybersecurity news outlet Zaufana Trzecia Strona reported an attack attributed to a person using the alias “Fingerprint”. Initial information about its scale came mainly from the person claiming responsibility. Fakturownia subsequently confirmed unauthorised access to some of its data.
Incident reported to CERT Polska
Gawkowski said the company had suffered a cyberattack, that CERT Polska had been notified and that authorities were working intensively to establish the circumstances. According to the minister, Fakturownia is cooperating with the relevant state institutions and the perpetrators are being pursued.
This marks a significant change from the initial reports: the occurrence of a cyberattack no longer rests solely on the alleged attacker’s claims, but has been confirmed by the company and a government representative.
Which data may have been affected?
According to Fakturownia, unauthorised access may have involved user and customer account information, password hashes, bank account numbers, payment information, and application system keys and passwords. The company also referred to invoices issued in the system before 2023.
Fakturownia stressed that data associated with KSeF or other integrations was not breached, and that payment card data remained secure. It said the leak did not include invoices issued after 2023 and that no data stored in its systems was deleted.
The company is working with CERT Polska and the Central Bureau for Combating Cybercrime. The incident was also reported to the President of Poland’s Personal Data Protection Office. Fakturownia said it would directly notify customers whose data was included in the leak.
Invoice data could be used in fraud
Invoices contain information about sellers and buyers, transaction amounts and bank accounts. Access to such documents can make it easier to prepare messages impersonating a business partner, for example requesting payment to a different account. There is no confirmation that data from this incident has already been used in that way.
What should Fakturownia users do?
The company recommends changing the account password and changing it on any other service where the same password was used. It also recommends enabling two-factor authentication and checking account settings, particularly bank account numbers and the list of users with access.
Users should be especially cautious about emails, text messages and calls impersonating banks, authorities, Fakturownia or business partners. They should not disclose passwords, verification codes, BLIK codes or payment card information. Requests to change payment account details should be confirmed directly with the business partner through a previously known contact channel.
Source: ManagerPlus, citing Fakturownia, Krzysztof Gawkowski and Zaufana Trzecia Strona.
