Polish invoicing platform breach shows the limits of access control

What happened

In early 2025, one of Poland's widely used online invoicing platforms suffered a cyberattack that potentially exposed information belonging to its users, their customers and business data stored on the platform ^[1]. The platform is used by thousands of Polish businesses to generate and manage invoices.

The details of how the attackers gained access have not been made public, but the nature of invoicing platforms means the breach may have touched invoices, customer names, addresses, tax numbers and payment details. For many small businesses, invoicing software holds the core of their accounting records.

The regulatory picture

Invoicing platforms process personal data and commercial records, so two sets of rules apply immediately.

Under GDPR Article 32, controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including protection against unauthorised or unlawful processing and against accidental loss, destruction or alteration ^[2]. Personal data in invoices, customer names, addresses and tax identifiers all fall within that duty.

Poland's Cybersecurity Act, which implements the NIS2 Directive, requires essential and important entities to report significant incidents. An early warning must be sent within 24 hours of becoming aware of an incident, followed by an incident notification within 72 hours and a final report within one month ^[3]. The clock starts when the organisation becomes aware, and being able to show when that was can matter if the timeline is questioned.

Invoices themselves are accounting records. Under Polish accounting law, as in most jurisdictions, they must be kept for a set number of years in a durable and secure way. If an attacker altered invoices or deleted records during the breach, the organisations using the platform face a second problem: they may no longer be able to rely on their own books.

The evidence gap

Access controls, encryption and monitoring are the foundation of data security. This breach appears to show what happens when those controls are bypassed. Once an attacker is inside a system with sufficient privileges, logs and records can be changed, and the change often leaves no trace that someone without deep forensic access could check.

That matters for two reasons. First, in the immediate response: incident handlers need to know what happened, and logs that could have been edited are harder to trust. Second, in any later inquiry: a supervisor, auditor or court may ask what was accessed, what was changed and when the organisation knew. If the logs themselves were within the attacker's reach, the answer becomes harder to give with confidence.

The problem is not that access controls failed to stop the attack; all controls can fail. The problem is that there was no independent record, outside the attacker's reach, to show what the logs said before, during and after the incident.

What this means for you

If you run or rely on a platform that processes business-critical data, a few questions are worth asking now:

• Could you show, after an incident, that your logs have not been altered, even by someone who gained administrator access?
• If invoices or records were changed during a breach, would you know which ones, and could you prove it?
• When you report an incident to a supervisor, can you demonstrate when you first became aware of it?
• If a customer or auditor questions the integrity of a record months later, do you have an independent way to show it is unchanged?

The answers do not require a new architecture. They do require deciding early what needs to be provable and putting something in place that makes it so.

Logs that hold up under scrutiny

Access controls, monitoring and backups are necessary. They are not, on their own, sufficient to show that a log is unchanged when the people keeping the log could also edit it.

Here, the thing to seal is each log segment as it closes: access logs, incident detection records and the first-awareness timestamp. Sealing takes a fingerprint of the segment, not the content, so the log itself never leaves your systems. The fingerprint is posted to WitniumChain, which returns a witness ID and a verification link. If the log is questioned later, anyone you share it with can recalculate the fingerprint and check that it matches the sealed one.

What it shows: that the log segment has not changed since it was sealed, even by someone with administrator rights.

What it doesn't: it doesn't replace access control, monitoring or backups, and it doesn't show that the log is complete or that the response was adequate. It shows that what you have now is what you had then.

Sealing happens through the REST API, the SDK or the MCP server. The content stays with you. The first 2,000 witnesses each month are free.

How it would work

1. Your logging system closes a segment every few minutes and sends its fingerprint to the API.
2. The API returns a witness ID. You store that ID alongside the segment.
3. When the log is questioned, you or an auditor recalculates the fingerprint and checks it against the sealed one using the witness ID.

What to watch

Under the Cyber Resilience Act, manufacturers of products with digital elements will need to document vulnerabilities and maintain logs of security-relevant events. The act is expected to apply from late 2027 for most products ^[4]. For software used in business-critical processes, the ability to show that logs and records have not been altered will be part of demonstrating due care.

Poland's Cybersecurity Act is already in force, and the 24-hour early warning rule is strict. When the question is not just what happened but when you knew, an independent timestamp on the first detection note can shorten a difficult conversation.