Fakturownia, a widely used Polish invoicing platform, confirmed today, 29 September, that an attacker had gained access to its servers. Bank account numbers, business partner details and older invoices may have been exposed. Those are the ingredients of a convincing invoice fraud.
What happened?
According to the company’s notice of 29 September, it found on 28 September that an unauthorised person had exploited a vulnerability to access its servers. Fakturownia says the following data may have been exposed:
- account data for users and their companies, and password hashes (passwords were not stored in readable form);
- bank account numbers and payment information;
- application and integration keys;
- data on customers and business partners;
- invoices issued before 2023.
Payment card data and the integration with KSeF, Poland’s national e-invoicing system, were not affected, the company says. It has reported the incident to CERT Polska, the Central Bureau for Combating Cybercrime and the Polish data protection authority.
The full scale is not yet clear. Poland Insight notes that the early information about it came mostly from the person claiming responsibility. As of 29 September there was no confirmation that the leaked data had been used for fraud.
Why are leaked invoices dangerous?
In an invoice fraud, a company receives an invoice that seems to come from a supplier it knows. Everything looks right except the bank account. The covering email explains that the supplier has changed banks and asks you to pay the new account.
Leaked invoices tell a fraudster who trades with whom, for what amounts and into which accounts. With that, a fake invoice is easy to make believable. Estonia’s Information System Authority (RIA) has described how fraudsters usually first break into a mailbox and watch the correspondence before swapping a real invoice for a fake one. With leaked invoices, much of that groundwork is already done.
Does it affect Estonian companies?
Fakturownia’s own users are affected directly. But if you do business with Polish companies, your company name, contact details and invoice amounts may sit on their invoices. A fake invoice could then reach you, or be sent to your customers in your name.
The same risk applies to any invoicing or accounting software. When all your invoices live in one cloud service, it is an attractive target.
How to verify a bank account change
- Confirm every change through a second channel. If a partner announces a new bank account, phone the contact person named in your contract. Do not use the contact details in the email that announced the change. RIA gives the same advice, and so does Fakturownia.
- Make it a rule. Agree internally that nobody pays a new account until someone has confirmed the change by phone. You can set an amount above which the check is mandatory. Urgency is the fraudster’s favourite tool.
- If you use Fakturownia, follow its advice. Change your password, and change it anywhere else you used it. Turn on two-step login, and check the list of users and the bank account numbers saved in your account.
- Review your own invoicing or accounting software. Check that two-step login is switched on and that no former employees still have access.
- If money has gone to the wrong account, call your bank at once. The sooner the bank knows, the better the chance it can recall the payment. Report the fraud to CERT-EE (cert@cert.ee) as well.
Fake invoices often arrive in emails that appear to come from the partner’s own domain. Our guide What is DMARC explains how companies can make that kind of spoofing harder.
Sources
- Fakturownia: Komunikat z dnia 29.09.2026 (company notice, Polish)
- Poland Insight: Fakturownia confirms cyberattack and data leak, KSeF and card data unaffected
- RIA: Levivad arvepettused! Kontrolli, enne kui maksad (Estonian)
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
