Invoices are a surprisingly complete record of who a business is, who it trades with and where its money sits. That is why the breach at Fakturownia, a Polish online invoicing service used by more than 600,000 companies, matters beyond Poland. The Record reports that an attacker exploited an unidentified vulnerability to get onto the company's servers, and that the firm spotted it early this week.
What was taken
Account and company data, password hashes, bank account details, authentication and integration tokens, details of customers and business partners, and invoices issued before 2023. Payment card data is said to be untouched, and so is information from integrated third-party services. A person using the name "Fingerprint" has claimed the theft and talks of six terabytes of invoices; that number has not been verified, and we would treat it as a boast until someone shows otherwise. BeyondMachines has a short summary of the same facts.
The national e-invoicing angle
Fakturownia connects to KSeF, Poland's national e-invoicing system, so the first question was whether the state platform was affected. The Finance Ministry says a review found no breach of KSeF and no leak of the data it holds, and Fakturownia says the certificates used to reach KSeF remain secure. Poland's digital affairs minister, Krzysztof Gawkowski, called it "another cyber incident affecting a private company". Rotating keys is the obvious thing for customers to do anyway, because a token that was stored is a token that may have been read.
Tokens are the quiet risk
Password hashes get the headlines, but integration tokens are the more interesting loot. An invoicing tool is plugged into the accounting package, the bank feed, the CRM and the shop. Each of those connections is held together by a secret sitting in the vendor's database. If an attacker has them, resetting the user password changes nothing. The company says it has rotated passwords and application keys, moved to new servers and brought in outside specialists, and it has notified Poland's security and data protection authorities. Customers still need to rotate on their side.
- List every system your invoicing tool is connected to and revoke and reissue each token or API key, not just the login.
- Change the password, and anywhere you reused it. Hashes are not plaintext, but weak ones fall quickly.
- Tell your finance team that supplier bank-detail change requests need a call-back for the next few months. Real invoices with real account numbers are exactly what makes a fraudulent one convincing.
- Check whether you are a processor for your own customers' data in that tool. If you are, UK or EU GDPR notification duties may apply to you as well as to the vendor.
- Add invoicing and billing platforms to your third-party register with a named owner and a documented exit route.
We see this pattern repeatedly in vendor reviews: the finance SaaS is bought by a department, never goes through security review, and ends up holding more sensitive data than the CRM. To talk through a vendor inventory, email sales@halfteck.com.