InvoiceOcean said that on September 28, 2026 it established a personal data breach in which an unauthorized person accessed its systems from September 27 and copied a large part of the database, affecting every account in the service [1]. Taken data vary by category and date and include company and user names, emails, phone numbers, tax IDs, bank account numbers and hashed passwords; the flaw was closed on September 28 and UODO, CERT Polska and police were notified [1]. InvoiceOcean asks users to set a new password, enter new API keys in integrations, and confirm any request to change a bank account number by phone using a number they already knew [1].
Backfill: this event became public on Oct 2, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillOfficially confirmed
Polish invoicing platform InvoiceOcean/Fakturownia: database copied, every account affected
1 min read
- Disclosed
- Oct 2, 2026
- Occurred
- Sep 27, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Technology
- SaaS platform
- Attack vector
- Vulnerability exploitation
- Impact
- Data exfiltration
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
Timeline
Technical details
Remediation
Vendor guidance
- 1Rotate password and API keys mitigate[1]
Set a new password and replace API keys in integrations.
References
Official / primary1
- [1]InvoiceOcean (Fakturownia)2026-10-02Accessed 2026-11-11Snapshot 2026-11-11 sha256 d64415fd7b45
“On 28 September 2026 we established a personal data breach. An unauthorised person gained access to our systems and copied a large part of the database to their own servers.”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.