Fakturownia, one of Poland's largest online invoicing platforms, has disclosed a cyberattack that exposed account data, bank account numbers and authentication tokens belonging to its business users, The Record reported Thursday. A hacker using the name Fingerprint claims to have stolen 6 terabytes of invoices, a figure that has not been verified.

What Happened

Fakturownia, which says more than 600,000 businesses use its service, detected unauthorized access Monday. The company said it then blocked the attacker, began rotating passwords and application keys and brought new servers online.

According to the company, the exposed data includes user and company account details, password hashes, bank account information, authentication and integration tokens, information about customers and business partners, and invoices issued before 2023. Fakturownia said payment card data and data held in third-party integrations were not compromised.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The person behind the Fingerprint alias contacted journalists and supplied material meant to show access to the company's infrastructure, The Record reported. The same actor has claimed responsibility for earlier breaches at MyDr and Medyc, two Polish healthcare software providers.

The incident has been reported to Poland's cybersecurity and personal data protection authorities.

Government Response

Fakturownia connects to KSeF, Poland's National e-Invoicing System, which raised concern that the government platform could be affected. The Finance Ministry said a review found no breach of KSeF security and no leak of data stored in the system, and Fakturownia said the digital certificates used to access KSeF remained secure.

Digital Affairs Minister Krzysztof Gawkowski called it another cyber incident affecting a private company and said those responsible are being pursued and will face serious consequences. He also said recent attacks show the private sector needs to invest more in cybersecurity.

Why It Matters

The combination of data is useful for invoice fraud, one of the most common and costly forms of business email compromise. With real invoices, customer lists and bank account numbers, criminals can send payment requests that match genuine past transactions, or tell a business partner that a supplier's bank details have changed. Small companies that rely on an online invoicing service often lack the verification procedures larger firms use to catch such requests.

The exposed integration and authentication tokens are a second risk. Tokens can allow access to connected systems without a password, which is why rotating them quickly matters. Password hashes can be cracked offline if they were weakly protected, putting users who reuse passwords on other services at risk even after Fakturownia's reset.

Context

Poland has been moving businesses onto mandatory e-invoicing through KSeF, and commercial services like Fakturownia act as the front end many small companies use to issue and submit invoices. A single platform at that layer can hold billing records for hundreds of thousands of businesses, which is what makes a breach there so damaging. The Fingerprint claims also point to a run of attacks on Polish software vendors that hold sensitive data for thousands of downstream customers.

What to Watch

Regulators are reviewing the breach, and the data protection authority could examine whether Fakturownia's safeguards met legal requirements. Customers should treat any request to change payment details with suspicion and confirm it by phone. Whether Fingerprint publishes or sells the data it claims to hold will determine how widely the fallout spreads.