---
title: "Data breach at VosFactures (FACTUAL SAS)"
description: "FACTUAL SAS, operator of the online invoicing service VosFactures, announced on September 29, 2026 that it had been informed of a cybersecurity incident affecting an external technical provider, the Polish company Fakturownia, whose infrastructure processes part of the service's data. An unauthorize"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-29-vosfactures-factual-sas
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-29
dateModified: 2026-09-29
---
# VosFactures (FACTUAL SAS)

Data breach — Moderate

FACTUAL SAS, operator of the online invoicing service VosFactures, announced on September 29, 2026 that it had been informed of a cybersecurity incident affecting an external technical provider, the Polish company Fakturownia, whose infrastructure processes part of the service's data. An unauthorized party exploited a flaw in a PDF invoice generation mechanism to access configuration files, then gained read access to a replica of the production database. Data relating to VosFactures accounts, to users' clients and suppliers, and to part of the documents generated through the service were affected.

Access to account, client and supplier information along with invoice content could be used to craft targeted phishing attempts impersonating a genuine business partner.

| Fact | Value |
| --- | --- |
| Disclosed on | September 29, 2026 |
| Incident dated | September 28, 2026 |
| Sector | Digital services |
| Country | France |
| Cause | Third-party provider |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Customer ID
- Full name
- Postal address
- Employment data

## What you can do

- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [VosFactures](https://frenchbreaches.com/alertes/vosfactures-muoqv8ylnty27ia39xm) — FrenchBreaches
- [VosFactures : fuite de données après une cyberattaque chez un prestataire](https://fuitesinfos.fr/article/2026-10-01-vosfactures) — Fuites Infos
- [VosFactures touché par une cyberattaque : les factures exposées](https://www.cyberattaque.org/vosfactures-touche-par-une-cyberattaque-les-factures-exposes/) — cyberattaque.org
- [Customers' data breached in cyberattack on popular Polish invoicing service](https://tvpworld.com/95653054/popular-polish-invoicing-service-fakturownia-hit-by-cyberattack) — TVP World
- [Wyciek danych z Fakturownia.pl. Wicepremier i resort finansów reagują](https://www.rp.pl/dane-osobowe/art45212951-wyciek-danych-z-serwisu-do-fakturowania-wicepremier-i-ministerstwo-finansow-reaguja) — Rzeczpospolita
- [Kolejny wyciek danych - cyberatak na Fakturownię. Wyciekły dane firm i ich kontrahentów](https://dorzeczy.pl/kraj/950230/kolejny-wyciek-danych-cyberatak-na-fakturownie-wyciekly-dane-firm-i-ich-kontrahentow.html) — DoRzeczy

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-29-vosfactures-factual-sas
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees