Fakturownia data breach in Poland: what businesses must do even after the 72-hour deadline

On 28 September 2026 Fakturownia, a Polish online invoicing platform reporting over 600,000 customers, discovered that an intruder had entered its systems and copied a large part of its database. According to the company, the incident affects every account. This update tells businesses invoicing through Fakturownia, including Polish subsidiaries of foreign groups, why the provider’s notification does not discharge their own duties and what to do after the 72-hour deadline. Legal advice is most useful where invoices contain data of individuals.

Fakturownia: customer and invoice data leak following a cyberattack

The unauthorised access lasted from 27 to 28 September. According to Fakturownia’s incident statement, the copied data include account and user data (with password hashes), data of contractors added before 16 October 2024, the full content of invoices issued before 22 March 2021 and invoice amounts for the entire period. For about 2,250 accounts, all data from 2022 to 2026 were taken. The company states that certificates for KSeF, Poland’s National e-Invoicing System, were not taken. On 29 September it notified the Polish data protection authority (UODO), and since 1 October it has been sending individual notices to customers.

Who is affected by the Fakturownia data breach?

Every business with a Fakturownia account. The customer is the controller of data entered into the account (contractors, invoices, payments) and Fakturownia processes them on the customer’s behalf. Company data are not personal data, but data of sole traders, consumers and contact persons are. Accounting firms issuing invoices for clients should also inform them without delay.

What to do after the Fakturownia data breach?

Fakturownia’s notice started the 72-hour period for notifying UODO under Article 33 of the GDPR. For most businesses it most likely expired on 4 or 5 October.

The duties remain:

• record when you received the notice and keep it,
• assess the risk to individuals whose data were in your account; Fakturownia’s assessment concerns its own data and does not replace yours,
• notify UODO unless a risk to those individuals is unlikely; if late, give reasons for the delay, and supply missing details later,
• where the risk is high (for example, a national ID (PESEL) number or a private bank account on an invoice), inform the individuals concerned,
• record the breach in your internal register, even if you do not notify it,
• change passwords and API keys, and confirm by phone, on a known number, any request to pay into a new bank account.

Fakturownia offers a partly completed notification form, but the controller remains responsible for its content.

Consequences of inaction

Failure to notify UODO or to inform individuals is a separate GDPR infringement, subject to a fine of up to EUR 10 million or 2% of annual worldwide turnover. A practical threat is fake invoices and payment demands: the attacker knows amounts, contractors and bank account numbers.

For more on a controller’s duties after a breach, see our article. Our data protection team will help you assess the risk, determine your obligations towards UODO and data subjects, and prepare the required notifications to UODO and communications to data subjects. Contact us to respond to the incident quickly and correctly.