Update no. 1, published on 2 October 2026. The previous statement of 29 September 2026 is at the bottom of this page. We will mark every update with a number and a date.
On 2 October 2026 we started sending two kinds of message:
Because of the number of recipients, sending may take several hours. If you do not receive a message, check your spam folder. You will also be able to read the notification after logging in to your account in the coming days.
In addition, we are making available to account owners a panel inside the application with detailed information: categories of data, date ranges and record counts.
Our messages never contain:
We never ask for your password, by e-mail, by phone or in chat. Do not rely on the sender name shown in your mailbox, because it can be forged. If a message raises any doubt, do not click the links in it. Open invoiceocean.com yourself by typing the address into your browser and check the messages in your account. Everything important from us is also available after you log in.
An unauthorised person gained access to our systems and copied data from the database to their own servers. Type of breach: a breach of confidentiality, meaning that data were copied. We are analysing the incident together with CERT Polska, the national computer security incident response team in Poland.
All times are Central European Summer Time.
For each category we indicate who is the controller of the data and which period the copying covered. (a) InvoiceOcean means data of the account and its users, for which the operator of the service is the controller. (b) Customer means data of contractors and other people that the customer entered into the account and entrusted to us for processing as their controller.
| Category of data | Controller | What was taken |
|---|---|---|
| Company and user data: company name, tax identification number, address, first and last names, e-mail addresses and phone numbers of users, account identifier | (a) Fakturownia sp. z o.o. | in full, where entered |
| Department data: address, tax identification number, bank name, account number, IBAN, SWIFT | (a) Fakturownia sp. z o.o. | in full, where entered |
| Hashed user passwords (passwords were not stored in plain text) | (a) Fakturownia sp. z o.o. | in full |
| API tokens and integration keys stored directly in account settings | (a) Fakturownia sp. z o.o. | in full, depending on the integrations used |
| Session identifiers | (a) Fakturownia sp. z o.o. | in full |
| Invoice amounts: net, VAT and gross by rate, currency, amount paid and amount outstanding | (a) Fakturownia sp. z o.o. (b) Customer | invoices from the entire period |
| Bank account balances retrieved through the bank account connection feature | (a) Fakturownia sp. z o.o. | in full, only where the integration was active |
| Contractors: name or first and last name, tax identification number, address, delivery address, e-mail, phone, bank account number, note, custom fields | (b) Customer | only contractors added before 16 October 2024 |
| Contractor panel: access link and, if the contractor set one, the password hash | (b) Customer | only contractors added before 16 October 2024 |
| Additional invoice parties (for example recipient, payer): name or first and last name, tax identification number, address, e-mail, phone, note; content of additional description fields (for example "Notes", "Recipient", custom labels) | (b) Customer | invoices from the entire period, to the extent the fields were filled in |
| Full invoice content: seller, buyer, number, dates, amounts, payment method and due date, notes | (b) Customer | only invoices issued before 22 March 2021 |
| Invoice line items: product names, quantities, prices | (b) Customer | only invoices from before 6 June 2019 |
| Payments: dates, amounts, transfer titles, names and account numbers of senders | (b) Customer | to the extent they were entered |
| Products and price list: names, codes, descriptions, prices | (b) Customer | in full |
| Data imported from files (invoices, contractors, products) | (b) Customer | to the extent they were entered |
| Content of exports and imports requested in the system | (b) Customer | requested up to 6 March 2026, for the most part |
| Warehouse documents | (b) Customer | only from before 14 July 2023 |
| Warehouse operations | (b) Customer | only from before 16 May 2022 |
| Account activity history | (a) Fakturownia sp. z o.o. | only from before 24 November 2021 |
| Information about attachments: name, type, size, date | (b) Customer | only files added before 6 November 2025 |
We established the cut-off dates from database query logs; they may be off by up to a couple of weeks. Copying of the largest data sets proceeded from the oldest records and was interrupted before it reached the newer ones. For invoices issued on or after 22 March 2021, neither the buyer name nor the invoice number was taken.
Other users of accounts: their e-mail address and password hash were taken, and, where provided, their first and last name, phone number and account identifier.
About 2,250 accounts: from these accounts all data available in the system from the years 2022 to 2026 were taken, up to a date that differs for each account. The owners of those accounts receive a notification with the information specific to their account.
The following were not taken:
To the best of our knowledge the data covered by the breach have not been made public so far. We are monitoring this together with CERT Polska. We will publish new findings on this page and in further e-mail messages.
Below we describe what may happen. It does not mean that it has already happened.
| What may happen | What we recommend |
|---|---|
| Messages and phone calls from fraudsters impersonating InvoiceOcean, a bank, a public authority, a contractor or an employer. They may look credible, because they contain real company, invoice and payment data. | Do not open links or attachments in unexpected messages. Never give out passwords, verification codes or payment card details to anyone. If someone calls claiming to be from your bank, a public authority or from us, end the call and dial back a number published on that institution's official website. Confirm a request from "your manager" for an urgent transfer through a different channel. Report suspicious messages to the computer security incident response team in your country. |
| Attempts to take over your account and, if you reused the same password, accounts in other services as well. | Set a new password to your InvoiceOcean account - learn how. Change the password in other services if it was the same. Review the list of users and the account settings. We also recommend that you enable two-step verification - learn how. |
| Use of stolen keys to reach your account through an integration. | Enter new API keys in your integrations. |
| False invoices, payment demands and requests to transfer money to a changed bank account, sent in the name of your company or to your company "from a supplier". The fraudsters know the amounts and know which invoices are unpaid. | Confirm every request to change a bank account number, and every unusual transfer, with your contractor by phone, using a number you already knew, not a number from the suspicious message. Where your country provides an official register of taxpayers or bank accounts, check your contractors' account numbers there, and check the account numbers shown on your own invoices in the application. |
If you suspect fraud or an unauthorised transfer, contact your bank without delay. If you suspect a crime, notify the police and keep the messages and other evidence. Please also tell us about any attempt to use the data covered by the breach.
For the data in group (b), that is data of contractors and other people entered into the account, the customer is the controller and we process those data on the customer's instructions under the data processing agreement that forms part of our terms. The e-mail message "Notification of a personal data breach", which you will receive shortly, is in that respect a notification of the breach to the controller (Article 33(2) GDPR). We are providing information in phases (Article 33(4) GDPR): in the coming days we will make available, inside your account, a panel with detailed information for that account, covering categories of data, date ranges and record counts, which will also make it easier to inform your contractors.
As the controller of those data, you assess the risk and decide whether and how to notify the people concerned. For the data for which we are the controller, we assessed the risk as high: the scope of the data is broad and the number of people is very large. You may use that as a reference point for your own assessment. The risks to third parties, and the steps you may wish to consider, such as informing your contractors about the risk of impersonation and false payment demands, and changing contractor panel passwords that were reused elsewhere, are described in e-mail message no. 1.
The 72-hour deadline for notifying your supervisory authority runs from the moment you become aware of the breach. Under the EDPB guidelines 9/2022 (point 44), a controller is as a rule considered aware once the processor informs it. If, however, you already had sufficient certainty about the incident earlier, for example from our statement of 29 September 2026, the deadline may have started to run earlier. You can submit a preliminary notification on the basis of e-mail message no. 1 and supplement it later.
We are sorry for this situation. We will keep publishing further findings on this page, and we will mark every update with a number and a date.
Yes. The incident concerns every account in the service. What was taken differs by category of data and by date; the table above sets out the scope and the cut-off dates. Account owners receive an individual notification by e-mail and will find detailed information for their account in the application.
No. Passwords were stored as hashes, not in plain text, and hashes are what was taken. We still recommend that you set a new password, change it anywhere else you used the same one, and enable two-step verification.
The full content of invoices was taken only for invoices issued before 22 March 2021, and line items only for invoices from before 6 June 2019. Invoice amounts were taken for the entire period. For invoices issued on or after 22 March 2021, neither the buyer name nor the invoice number was taken.
Our messages never contain attachments, never ask for your password, for an SMS or two-step verification code or for payment card details, and never ask you to log in through a link to verify your account. Do not rely on the sender name, because it can be forged. If in doubt, type invoiceocean.com into your browser yourself and check the messages after logging in.
Set a new password to your account, change it in other services if it was the same, enable two-step verification, review the list of users and the account settings, enter new API keys in your integrations, and confirm every request to change a bank account number by phone using a number you already knew.
For data of contractors and other people that you entered into your account you are the controller and we are the processor. The e-mail notification is a notification of the breach to you as controller under Article 33(2) GDPR. You assess the risk and decide whether to notify the people concerned. A panel with detailed information for your account, including categories of data, date ranges and record counts, will be made available in the coming days.
Yes. The attacker's access was cut off on 28 September 2026, traffic was moved to new servers built from scratch, the stolen keys were deactivated, application keys and service passwords were changed and customer API tokens were replaced. Existing API keys now work only from the IP addresses previously used by the users of the account.
If you want to check whether this concerns your account, or you need help securing it, write to us. Questions about the processing of your personal data can be sent the same way.
This is the statement of 29 September 2026, kept for the record. Some of its findings were corrected by update no. 1 above, in particular the scope of invoice data and of contractor data.
Published on 30 September 2026. We will update this page as soon as we establish anything new.
On 28 September 2026 we detected unauthorised access to the servers of the invoicing system on which InvoiceOcean runs. As a result of the incident, an unauthorised person had visibility of user account data, contractor data and documents generated through the service.
We understand that such news may be worrying, which is why we want to give you all the information we currently have. We also explain what you can do to protect your data further. At the same time we can confirm that the incident did not affect data held within our integrations and add-ons.
An unauthorised person managed to exploit a vulnerability in the system, which resulted in unauthorised access to part of the data. After detecting the event, we blocked that person's access, started rotating keys and passwords and launched new application servers. Together with external security specialists we are continuing to analyse the situation.
What we know at this point:
Based on our findings so far, the unauthorised person may have had access to the following data:
If further analysis brings new findings, we will update this statement without delay.
To give your account additional protection, we recommend that you:
It is possible that in the near future you will receive e-mails, text messages or phone calls from people impersonating well known institutions - a bank, a public authority, a courier company, InvoiceOcean or your own contractors. Such messages often create time pressure and push you to act quickly. Please:
We are still establishing which customers are affected by the leak. We will notify each of them directly in the near future.
We are sorry for this situation. The security of your data is our priority and we are investigating the matter with full commitment. We will keep publishing further findings on this page.