Hackers Leak Passwords and Old Invoices from Accounting Firm

Accounting software provider Fakturowania reported a cyberattack that led to unauthorized access of user credentials, business partner data, bank account numbers, payment records, system keys, and tax invoices issued prior to 2023. The incident was discovered on September 28 and officially notified by the company on Tuesday, with authorities alerted via CERT Polska. While attackers accessed parts of the database including short passwords and legacy documents, no breach occurred regarding data integrated with KSeF or other official systems. Payment card information remained secure throughout the attack.

A hacker operating under the alias 'Fingerprint' admitted to stealing approximately 6 terabytes of invoices from a related client portal, stating he accessed them because they were required for error reporting logs rather than malicious intent. This marks a second data theft involving Fingerprint, who previously compromised medical records from MyDr and Qbusoft.

The firm emphasized that no documents issued after 2023 or any linked integrations were exposed during the breach, though full verification of all stolen files remains pending investigation by state services.