Breaches and incidents
Fakturownia (Poland) and its French brand VosFactures (FACTUALI SAS): invoicing platform breached via PDF generation flaw
TVP World reported on 29 Sep that customer data was breached at the Polish invoicing service Fakturownia.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- TVP World reported on 29 Sep that customer data was breached at the Polish invoicing service Fakturownia. Per Cyberattaque.org, quoting VosFactures’ customer notice, Fakturownia detected unauthorized access on 28 Sep 2026, and an unauthorized person could access account data; password hashes, bank accounts, payment information, invoices and technical tokens and secrets may have been accessed.
- Root cause: per the notice reported by Cyberattaque.org, “a vulnerability affecting the PDF generation mechanism from invoice templates”.
- No attacker named.
- Fakturownia cut the attacker’s access, rotated keys and passwords, deployed new servers, engaged external specialists and reported to Polish authorities; all existing API codes for integrated accounts were to be invalidated on 1 Oct. Payment card data was reportedly not affected.