France's e-invoicing reform was a month old. Since 1 September 2026, every business in France has had to be able to receive electronic invoices through an approved platform (a plateforme agréée, or PA), and large and mid-sized companies have had to issue them that way too. On 29 September, FACTUALI, the company that runs VosFactures, one of those approved platforms, was told of an intrusion at its technical contractor, the Polish firm Fakturownia. Two days later, the French state suspended exchanges between its own services and the platform, as a precaution, for a few days.
So this is a French and Polish story. For the businesses that use VosFactures — it claims "more than 500,000 professionals" (VosFactures) — the question is a practical one: what leaked, and what should they do? For everyone else, including anyone outside France who invoices through an online service or turns documents into PDFs on someone else's server, the case is a reminder of something that's easy to forget: a document processed on a server also exists on that server.
What happened?
The contractor has published a detailed timeline (Fakturownia, update of 1 October). The attacker had access to its systems from around 3.20am on 27 September until around 5.45pm on 28 September. That access was cut off at 6.01pm, keys and passwords were changed, and the service was moved to new servers "built from scratch". At 2.35am on 29 September, Fakturownia added extra safeguards… to its PDF generator. The same day, the company notified Poland's data protection authority (UODO), its national incident response team (CERT Polska) and the police.
That, according to both companies, is how the attacker got in. VosFactures says the attacker exploited a vulnerability affecting "a mechanism for generating PDF files from invoice templates", which gave them access to configuration files containing "application keys and technical credentials". From there, they were able to run commands on several servers and obtain read access to a replica of the production database (FrenchBreaches, Econostrum). Fakturownia's chief technology officer confirmed the starting point to the Polish site Niebezpiecznik: the attacker found a flaw in the invoice templates, then a flaw in the library that generates the PDFs, and used them to extract the key that signs login sessions, which opened up access to the server (Niebezpiecznik). VosFactures says it has "no evidence" of any direct compromise of its own environment, which holds the SecNumCloud qualification from ANSSI — the security certification that France's national cybersecurity agency awards to cloud services.
What data was exposed?
The two companies don't say quite the same thing, and their statements have changed over time.
On the Polish side, Fakturownia says that "the incident concerns every account". The stolen data includes account details, IBANs, passwords (stored as hashes), API access keys, the amounts of all invoices, customer and supplier records added before 16 October 2024, and the full content of invoices issued before 22 March 2021. For around 2,250 accounts, all data from 2022 to 2026 was copied. Payment cards and certificates for KSeF, Poland's national e-invoicing system, are not affected. The first statement, on 29 September, spoke of invoices from before 2023; the update of 1 October is more precise, and broader on some points (Fakturownia). Fakturownia also sells its software under other brands abroad, including InvoiceOcean in the UK and Bitfactura in Spain. Bitfactura's own notice, dated 2 October, states that the incident "affects all accounts of the service, including all BitFactura accounts" (Bitfactura); InvoiceOcean's UK site displayed no notice as of 11 October.
On the French side, VosFactures mentions account data, data on its users' customers and suppliers, and some of the documents generated (Next). According to FACTUALI, payment card data was not affected; that statement covers its secure environment, without saying whether every account is hosted there (Fuites Infos). VosFactures invalidated all API keys on 1 October (Fuites Infos). The number of French customers actually affected hasn't been disclosed.
An attacker going by the name "Fingerprint" claims to have stolen 6 terabytes of invoices; the claim hasn't been verified (The Record). The same alias had previously claimed attacks on Polish medical services. Presenting themselves as an "ethical hacker", the attacker says they don't intend to sell the data; Polish security services suspect the attacker is Polish (Rzeczpospolita). As of 1 October, Fakturownia said the data had not been made public, and no publication had been reported by 11 October.
Why did the French state suspend the platform?
On the morning of 1 October, according to FranceTransactions, the AIFE (Agence pour l'informatique financière de l'État, the government agency that runs the French state's financial IT systems), which manages Chorus Pro — the platform through which the public sector receives its invoices — "provisionally" suspended its exchanges with VosFactures. It said that, at that stage, no invoicing data had been sent to the authorities through this platform, and that "no business can be penalised solely because of the consequences of this suspension" (the AIFE's notice, as reported by eWatchers). The suspension was lifted over the weekend of 3–4 October. The AIFE's banner notice, quoted by Next, explains that after reviewing the technical information supplied by the platform, "the operational situation of the PA's services and the security measures taken do not justify maintaining the suspension"; exchanges "naturally remain under monitoring, as with all partners" (Next, FranceTransactions).
The decision makes sense. Since 1 September, an e-invoice in France has had to go through an approved platform, which passes it on to the recipient and sends some of its data to the tax authority (LegalPlace; we explained the reform in France's e-invoicing reform: is your PDF invoice still valid?). The French public sector, for its part, no longer accepts invoices by email: "You can no longer send a paper invoice or a PDF by email to a public body," LegalPlace points out in its guide to Chorus Pro (LegalPlace). A compromised platform is therefore a link in a chain to which the whole French economy is now connected.
How can a PDF generator open the door to a server?
Neither VosFactures nor Fakturownia has published the exact technique: all we know is that it started with the invoice templates and the PDF generator. The attacker, for their part, told the Polish site Zaufana Trzecia Strona about a different way in: an SQL injection, which slips code into the queries sent to the database. That version hasn't been confirmed (Zaufana Trzecia Strona). But the family of flaws involved on the PDF side is well known to security specialists.
To turn an invoice template into a PDF, many services use an engine that interprets HTML — often a headless browser (one with no on-screen interface) — running on the server with extensive privileges. If a user can slip code into their template and the engine interprets it, several attacks become possible:
- server-side template injection, which means inserting code into the template's own syntax, and can, according to PortSwigger, let an attacker "take complete control of the server" (PortSwigger);
- local file reads and server-side request forgery (SSRF): an HTML-to-PDF engine can be tricked into including a file from the server in the PDF, or into querying internal services that expose credentials (Intigriti).
Flaws of this kind have been found in widely used tools: wkhtmltopdf in 2022, for forged requests to the internal network (NVD); the Python library ReportLab in 2023, for code execution (GitHub); and dompdf in 2022, for code execution through a booby-trapped font (Positive Security). The scenario both companies describe — an invoice template, a PDF generator, then configuration files, then keys, then the database — fits this pattern, though no one can say for certain that this is what happened.
What should affected businesses do?
The recommendations from Fakturownia, from VosFactures and from the French lawyers who have analysed the case all point the same way (Fakturownia, Leto, Kohen Avocats):
- Change your password, on VosFactures and anywhere else you reused it. Turning on two-factor authentication as well, where the service offers it, costs nothing.
- Regenerate your API keys if any software is connected to the platform.
- Treat any request to change bank details with suspicion (in France, a change of RIB: the relevé d'identité bancaire, the slip French banks issue with your account details). Exposed IBANs and customer–supplier relationships are exactly what's needed to pull off fake-supplier fraud, known in the UK as mandate fraud. Any such request should be confirmed by phone, on a number you already have. We go through the method in our guide to spotting a doctored invoice PDF. If an unexpected invoice arrives as an attachment, Inspect PDF tells you, without displaying or running it, whether it contains code, external links or automatic actions; it doesn't check the bank details.
- Document the incident. Each client business remains the data controller for its own customers' and suppliers' personal data: it must record the incident in its breach register and assess whether it needs to notify CNIL, the French data protection authority, within 72 hours (Leto, Kohen Avocats, CNIL).
- Don't stop paying your subscription to the platform unilaterally, which could see you ordered to pay the sums owed, and keep evidence of your exchanges: the notification you received, messages, login logs.
What about where you are? In the UK, e-invoicing isn't compulsory yet: the November 2025 Budget announced that from April 2029 businesses will have to issue all VAT invoices as e-invoices, with an implementation roadmap due at Budget 2026 (GOV.UK). If a supplier that processes personal data for you, such as an invoicing service, suffers a breach, UK GDPR requires it to tell you "without undue delay"; you must then record the breach, whether or not you report it, and notify the ICO within 72 hours of becoming aware of it if it's likely to put people's rights and freedoms at risk (ICO). For larger organisations and public bodies, the National Cyber Security Centre sets out twelve principles for keeping control of security across a supply chain (NCSC).
Lessons that go beyond VosFactures
None of this is an argument against the reform. E-invoicing is aimed first and foremost at VAT fraud, and approved platforms are supervised by the state. But the case illustrates three realities that apply to any online service.
A service is only as secure as its subcontractors. VosFactures wasn't attacked directly: its contractor was. The SecNumCloud qualification of its own environment didn't prevent the exposure of data processed elsewhere.
Platforms are becoming concentrated targets. An invoicing platform holds IBANs, business relationships and amounts for thousands of companies. That's exactly what payment fraudsters are looking for.
Every document created or transformed on a server is an attack surface. Generating, merging, converting or compressing a PDF on a server means the file — and sometimes the code that produces it — passes through that server (we traced that journey in Where do your files actually go when you use an online PDF converter?). For official invoices in France, there's no alternative: they have to go through an approved platform. For everything else — putting receipts together, shrinking a scan, extracting a page, watermarking a copy — there is one: do the work on your own machine. That's the principle behind PDFKami, whose tools run in your browser without sending your file anywhere.
Glossary
Approved platform (PA): plateforme agréée, formerly known as a PDP; an operator registered by the French authorities to issue, send and receive e-invoices.
AIFE: Agence pour l'informatique financière de l'État, the French government agency for the state's financial IT, which runs Chorus Pro among other things.
Chorus Pro: the French public sector's e-invoicing platform.
SecNumCloud: a security qualification for cloud services awarded by ANSSI, France's national cybersecurity agency.
API key: a secret identifier that lets a piece of software connect to an online service.
Template injection (SSTI): an attack that slips code into a template that the server interprets.
SSRF: server-side request forgery, an attack that forces a server to send requests to internal resources.
Breach register: registre des violations in French; the record that every data controller must keep under the GDPR, listing incidents that affect personal data.