VosFactures (FACTUAL SAS)
ModerateConfirmedDigital services
FACTUAL SAS, operator of the online invoicing service VosFactures, announced on September 29, 2026 that it had been informed of a cybersecurity incident affecting an external technical provider, the Polish company Fakturownia, whose infrastructure processes part of the service's data. An unauthorized party exploited a flaw in a PDF invoice generation mechanism to access configuration files, then gained read access to a replica of the production database. Data relating to VosFactures accounts, to users' clients and suppliers, and to part of the documents generated through the service were affected.
Access to account, client and supplier information along with invoice content could be used to craft targeted phishing attempts impersonating a genuine business partner.
- Disclosed on
- September 29, 2026
- Incident dated
- September 28, 2026
- Sector
- Digital services
- Country
- France
- Cause
- Third-party provider
Exposed data
- Customer ID
- Full name
- Postal address
- Employment data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- VosFacturesFrenchBreaches
- VosFactures : fuite de données après une cyberattaque chez un prestataireFuites Infos
- VosFactures touché par une cyberattaque : les factures exposéescyberattaque.org
- Customers' data breached in cyberattack on popular Polish invoicing serviceTVP World
- Wyciek danych z Fakturownia.pl. Wicepremier i resort finansów reagująRzeczpospolita
- Kolejny wyciek danych - cyberatak na Fakturownię. Wyciekły dane firm i ich kontrahentówDoRzeczy
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact