Fakturownia.pl, one of Poland’s most popular invoicing and accounting platforms used by over 600,000 businesses, reported on 29 September 2026 that it had detected unauthorised access to its servers. A hacker using the alias “Fingerprint” claimed responsibility, the same actor who previously stole data from the medical platforms MyDr and Medyc.pl. The attacker claims to have downloaded 6 terabytes of invoices, but Zaufana Trzecia Strona, the outlet that first reported the story, was unable to verify that figure. The incident was reported to the police, CERT Polska, the Central Bureau for Combating Cybercrime, and the President of the Personal Data Protection Office, and was publicly addressed by Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski.

What data may have leaked

According to Fakturownia’s notice, unauthorised access may have covered account data for all users, including password hashes, session, API, and integration tokens, bank account numbers, payment information, and the application’s own system keys and passwords. The incident also covered Fakturownia customers’ counterparty data and part of the information recorded on invoices issued before 2023. The hacker gave the outlet screenshots said to show access to the application server, the client list, and exported database records, and described the break-in method as a time-based blind SQL injection used to steal the master key of a Ruby application. That account, however, comes solely from the attacker and has not been confirmed by Fakturownia.

What is safe and what the incident does not cover

Fakturownia states that invoices issued after 2023 were not affected, nor were payment card details or data held in integrations with other systems, and nothing was deleted from the servers. Especially important for clients using the National e-Invoicing System (KSeF) is that the Finance Ministry confirmed on 29 September that the incident did not affect KSeF certificates or data held within the ministry’s own system. Fakturownia is an external software provider that can connect to KSeF, but data inside the Fakturownia application and data inside the state system are two separate sets.

What to do if you use Fakturownia

Fakturownia recommends changing your account password and the password for the email linked to that account, and changing it elsewhere too if the same password was reused on other services. It is worth turning on two-factor authentication where the platform offers it, and checking both the list of people with access to your company account and the bank account numbers shown on your invoices. Anyone running a sole proprietorship (JDG) should be especially alert to messages, calls, and texts impersonating Fakturownia, a bank, a government office, a courier company, or a business partner, particularly ones that cite real details from a past transaction and ask you to switch the bank account used to pay an invoice. A leak of counterparty data is exactly what makes a convincing scam easier to pull off, regardless of the rules for the VAT those invoices relate to.

Legal status as of 1 October 2026. The incident was reported to the President of the Personal Data Protection Office under the breach notification duty set out in Article 33 of the GDPR. As of this date, the full scale of the leak, including the attacker’s claimed figure of 6 TB of invoices, has not been independently confirmed by the company, independent security researchers, or state authorities.

Author: Walery Kusznirski, in-house legal practitioner at MojaFirma.