Data leak in Invoice House - Deputy Prime Minister Gawkowski informs about the security incident

On Tuesday, Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski informed on the X platform about a serious security incident that affected Fakturownia - a popular online invoicing and accounting system. The company confirmed that an unauthorized person exploited the security vulnerability by gaining access to some user data.

According to the official statement, the leak concerned, among others: data of user accounts and their contractors, invoices issued before 2023, password hashes, bank account numbers, payment information and application system keys and passwords. According to Fakturownia, there was no breach of data integrated with KSeF or payment card data.

Services on the trail of the perpetrators

The incident was reported to CERT Polska and the Central Office for Combating Cybercrime. The services are working intensively to determine the identity of the perpetrators, who - according to the editor-in-chief of the Zaufana Trzecia Strona website, Adam Haertle - may be linked to previous high-profile data leaks from MyDr and Qbusoft.

Deputy Prime Minister Gawkowski emphasized that support from state institutions for victims of cyberattacks is available 24 hours a day, and the perpetrators will be held accountable.

What data could have been leaked? Who is affected by the incident?

Representatives of the Invoice Office inform that unauthorized access could cover the data of all users and their contractors, as well as invoices issued before 2023. The company emphasizes that no data was deleted from the system and invoices issued after 2023 remained safe.

We are determining which customers are affected by the leak - each of them will be notified individually. The incident was also reported to the President of the Personal Data Protection Office.

Recommendations for users – how to protect yourself?

Invoice appeals to all users to immediately change the password for the account, as well as for the associated e-mail box and other websites where the same password was used. It is also recommended to enable two-step verification and carefully check the account settings, including the bank account number and the list of users with access to the system.

The company warns against fraud attempts - users may soon receive suspicious e-mails, text messages or phone calls impersonating known institutions. Under no circumstances should you provide passwords, verification codes or payment card details.