FACTUALI, the operator of VosFactures, says it was informed on 29 September 2026 of a cyberattack at its technical provider Fakturownia. Its user notification reports that an unauthorised party may have accessed VosFactures account data, customer and supplier data and some documents generated through the service. This analysis, published on 22 October, examines that late-September incident and its possible consequences for a small business.
Invoicing software holds more than your login address. It can also describe your trading relationships. If that information is exposed, a fraudulent request sent to your accounts team or a customer may appear familiar. VosFactures identifies this risk in its instructions; that does not establish that fraud has already occurred.
What VosFactures confirms about its provider
FACTUALI’s communication places the incident within Fakturownia’s infrastructure and reports exploitation of a flaw in its PDF-generation mechanism. According to information from the provider, this could have exposed configuration files containing technical credentials, followed by a database replica. This is the chain described by the operator, rather than an independent forensic finding.
FACTUALI distinguishes its own servers from those of its provider and says the electronic invoicing services operated directly in its environment were unaffected. That distinction does not remove the possible exposure of VosFactures data processed at Fakturownia. The two scopes need separate examination.
An incomplete picture for French users
In its statement updated on 1 October, Fakturownia confirms data copying between 27 and 28 September. Its findings include password hashes, access tokens and billing information, with different historical periods for different categories.
The French notification provides less detail: it does not establish the number of affected accounts or documents or which data was accessible for each business. Fakturownia’s categories and volumes should therefore not be attributed to every VosFactures user. Ask the operator for information specific to your company’s account and retain its replies alongside the notification.
Why customers and suppliers matter too
Third-party records in invoicing software change the implications of the incident. Your mailbox can remain protected while information about your trading partners sits in your invoicing application. A fraudster could use exposed commercial details to impersonate a familiar contact without accessing your email account. This is a risk scenario, rather than an observed outcome here.
VosFactures specifically warns about identity misuse, supplier impersonation and requests to change bank details. Even when a message cites a real transaction, confirm the change with the trading partner using a phone number already on file. Our article on business email compromise and executive impersonation explains independent verification.
Check the account and connected applications
Open VosFactures through your usual address to review the instructions for your account. If you reused its password elsewhere, replace the matching passwords, particularly on the mailbox associated with the account. VosFactures identifies password reuse as a risk; its French notification does not establish that every password was stolen.
Check integrations separately. In an email to users, VosFactures announced that old API codes would be invalidated on 1 October and asked users to create replacements in their account settings. An API code lets another application communicate with VosFactures: changing the login password does not perform that replacement.
If an accountant or integration provider set up the connection, have them check the instructions, replace the code where required and verify that the expected data flows again. An announced measure does not demonstrate that every integration was successfully updated. VosFactures also says it does not ask users to send these codes by email or telephone.
Organise the accounting team’s response
For a team using VosFactures, assign each action to someone: the account owner retains notices and contacts support; the integration administrator checks connected applications; the person responsible for payments reviews unusual requests. This prevents one person’s credential update from leaving another application disconnected or colleagues uninformed.
If information about your trading partners is confirmed as affected, work with the person responsible for data protection to prepare a communication suited to the established scope. Explain how recipients can verify requests from your company without claiming that all your invoices were copied. If a fraudulent transfer occurs, Cybermalveillance.gouv.fr recommends contacting the bank immediately and preserving evidence.
The connection with Soclyde
For people administering VosFactures and accounting applications, Soclyde helps create unique passwords and keep them in an encrypted vault on authorised devices. Sharing between users, included in Premium, lets an authorised colleague receive access while limiting password copies in team emails or documents.
That benefit concerns the organisation of human credentials. Revoking an API code and updating an integration still happen in VosFactures and the connected application. Soclyde does not protect the provider’s infrastructure, recover copied data or verify a supplier’s bank details.
Key points to remember
The VosFactures incident raises two questions for a small business: which access needs attention, and which information about its trading partners may have been exposed? The answers depend on notifications specific to your account. Distinguish the French service’s data from Fakturownia’s overall findings, check application connections and confirm bank-detail changes through a known channel.
To organise team access, read our team password-sharing guide and our guide to strong, unique passwords.
Generated editorial illustration: it does not depict an identified affected business.