178,000+ Invoices With Customers Personal Records Exposes from Invoice Platform Invoicely
In early October 2025, a publicly accessible database belonging to Invoicely, a Vienna-based invoicing and billing platform used by over 250,000 businesses globally, was discovered by cybersecurity researcher Jeremiah Fowler.
In early October 2025, a publicly accessible database belonging to Invoicely, a Vienna-based invoicing and billing platform used by over 250,000 businesses globally, was discovered by cybersecurity researcher Jeremiah Fowler.
The database contained 178,519 files in formats such as XLSX, CSV, PDF, and images, all containing sensitive personal and financial information.
Documents exposed included invoices, scanned checks, tax filings, and ride-sharing receipts. These revealed names, addresses, phone numbers, tax ID numbers, and bank details of healthcare providers, contractors, and corporate partners.
The unprotected nature of the database increased the risk of identity theft, spear-phishing, invoice fraud, and unauthorized financial transactions.
Initial investigations indicated that the database lacked encryption or password protection, making it accessible to anyone familiar with its URL structure.
After Fowler issued a responsible-disclosure notice through Invoicely's support system, the company restricted public access to the database within hours.
The extent of data exposure duration is unknown, raising concerns over potential data copying or monitoring by unauthorized parties before containment.
The database contained 178,519 files in formats such as XLSX, CSV, PDF, and images, all containing sensitive personal and financial information.
Potential risks include fraudulent invoice submissions using authentic invoice templates, counterfeit tax filings, and phishing campaigns based on genuine transaction details.
Website Planet analysts noted that the database name 'invoicely_backup_public' suggested it was intended for internal backup or third-party migration, but was misconfigured for public access.
This incident highlights recurring issues in cloud storage governance among SaaS providers, where rapid deployment and scaling often outpace security controls.
While no evidence of active exploitation was found, the risk of undetected data harvesting remains significant due to the exposure window.
The misconfiguration was due to an unsecured Amazon S3 bucket, mistakenly set to "public-read" instead of restricted access. Attackers could enumerate buckets using tools like AWSBucketFinder or basic HTTP requests.
A Python script example demonstrates how an adversary might list bucket contents:
s3 = boto3.client('s3', aws_access_key_id='', aws_secret_access_key='', config=boto3.session.Config(signature_version='s3v4')) response = s3.list_objects_v2(Bucket='invoicely_backup_public') for obj in response.get('Contents', []): print(obj['Key'])
This code snippet underscores the lack of authentication checks, illustrating how minimal code can expose thousands of files.
To mitigate such risks, SaaS providers must enforce strict access policies, automate storage audits, and adopt least-privilege principles in cloud resource provisioning.
Based on reporting by Cyber Security News.