Fakturownia.pl breach: what data may have leaked and what to do

The online invoicing service, which says it has more than 600,000 customers, has confirmed unauthorized access to its servers. The leak may also affect contractors who never had an account there.

Fakturownia.pl detected unauthorized access to its servers on 28 September 2026. The perpetrator, who signs as “Fingerprint”, claims responsibility for the breach. He provided the editors of Zaufana Trzecia Strona with screenshots: application directories, an excerpt from the customer list, and a list of files that appear to be a database export. According to reports, the same perpetrator is behind leaks from the medical systems MyDr (about 19 million people) and Medyc (about 5 million people).

Some of the information comes solely from the hacker. He claims he stole 6 TB of invoices, but Zaufana Trzecia Strona notes that it could not verify this. The description of the attack method also comes from him. According to this account, he extracted the application’s master key, used it to forge a session cookie, and executed his own code on the server.

In its official statement, Fakturownia says the following may have leaked:

• company account and user data, including password hashes,
• session tokens that keep users logged in, as well as API and integration tokens, i.e. keys for connecting to other systems,
• bank account numbers and payment data,
• data of contractors of all customers and some data from invoices, probably up to 2023,
• application system keys and passwords.

According to the company, KSeF (National e-Invoicing System) certificates, payment card data, and invoices issued after 2023 were not compromised. Niebezpiecznik.pl points out an inconsistency in the statement: the company admits that session and API tokens may have leaked, but invalidated only the API tokens.

Fakturownia has launched new servers, is replacing keys and passwords, and is analyzing the incident with external specialists. It reported the matter to the Central Cybercrime Bureau, CERT Polska, and the President of the Personal Data Protection Office. Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski confirmed the attack and announced that the perpetrators would be pursued.

The company and Niebezpiecznik recommend that users change their password in Fakturownia, in their email inbox, and anywhere else the same password was used. It is also worth enabling two-factor verification, that is, a second login factor, such as a code from an app. The next steps are logging out of all sessions, replacing API keys in integrations, and checking the bank account number and user list in the account settings.

The database also contains contractor data, so caution also applies to companies without an account in the service. Messages and phone calls impersonating banks or business partners, especially those asking for a change of account number, should be verified through another channel. Passwords or verification codes should not be given to anyone either.