Cyberattack on approved e-invoicing platform VosFactures exposes confidential data in France

A cyberattack on September 28 breached the approved e-invoicing platform VosFactures, leading to the theft of confidential files. The French state agency AIFE has suspended exchanges with the service as a precaution. The attack, claimed by a hacker named Fingerprint, targeted Fakturownia, Factuali's Polish technical provider. Stolen data includes account credentials, passwords, and client and supplier files. The attacker exploited a vulnerability in the PDF generation tool to access configuration files containing application keys. Factuali stated that banking data and e-invoicing services, hosted on its own servers, were not affected. The company has not disclosed the number of compromised accounts. This incident raises concerns about data security just one month after e-invoicing became mandatory for large and mid-sized companies, with smaller firms required to comply by September 2027.