178,000+ Invoices Expose Customer Data from Invoicely Platform

A data exposure incident has affected Invoicely, a cloud-based invoicing platform, potentially compromising sensitive information globally.

The exposed database contained 178,519 files, including Excel spreadsheets, CSV files, PDFs, and images. Notably, the database lacked security measures such as password protection or encryption, making it accessible to unauthorized parties.

The investigation revealed invoices containing personally identifiable information, including names, physical addresses, phone numbers, and tax identification numbers. Additional documents included airline tickets, ride-sharing receipts, health insurance records, and medical payment information.

Screenshots from the investigation showed scanned checks with routing numbers, account numbers, and check numbers, emphasizing the seriousness of the financial data exposure.

Cybersecurity researcher Jeremiah Fowler discovered the unprotected database, which included nearly 180,000 files with invoices, banking information, and confidential records. The database was linked to Invoicely, operated by Stack Holdings GmbH, a Vienna-based software company.

Following responsible disclosure protocols, Fowler notified Invoicely through their support system. The company responded by restricting public access to the database shortly after notification, although no official response was provided.

Invoicely offers cloud-based invoicing and billing services to businesses worldwide, providing tools for creating estimates, automating recurring billing, sending payment reminders, and tracking expenses and mileage. Operating on a freemium model, Invoicely serves over 250,000 businesses, offering both free and paid account tiers.

While the exposure timeline is unclear, details regarding access by unauthorized parties remain unknown. It is also uncertain whether Invoicely or a third-party contractor managed the database, pending an internal forensic audit.

This incident occurs amid increasing concerns about invoice fraud. The 2024 AFP Payments Fraud and Control Survey reported that 80% of organizations experienced payment or invoice fraud attempts in 2023, a 15% increase from the previous year.

Exposed data can provide criminals with insights into business relationships and financial accounts, facilitating sophisticated fraud schemes. Leaked tax documents present additional risks, containing Social Security numbers, dates of birth, and employer details that enable identity theft.

Security experts recommend encryption for stored information, regular vulnerability assessments, and continuous monitoring systems. Affected businesses and individuals should change passwords on related accounts, monitor credit reports for suspicious activity, and verify unexpected payment requests through official channels.

The incident underscores the importance of securing cloud-based platforms, especially those handling financial and personal information for users worldwide.

Based on reporting by GBHackers.