Polish invoicing platform InvoiceOcean/Fakturownia: database copied, every account affected

InvoiceOcean said that on September 28, 2026 it established a personal data breach in which an unauthorized person accessed its systems from September 27 and copied a large part of the database, affecting every account in the service ^[1]. Taken data vary by category and date and include company and user names, emails, phone numbers, tax IDs, bank account numbers and hashed passwords; the flaw was closed on September 28 and UODO, CERT Polska and police were notified ^[1]. InvoiceOcean asks users to set a new password, enter new API keys in integrations, and confirm any request to change a bank account number by phone using a number they already knew ^[1].

Industries mainly affected: Technology, Cross-industry

1. Set a new password ^[1].
2. Enter new API keys in your integrations ^[1].
3. Confirm any bank account change request by phone using a number you already knew .