Autopay S.A. announced on Friday, 13 November, that on 11 November it detected unauthorised access to its infrastructure and some data on processed payments. The company does not rule out that the data was copied.
What the company established
In a statement published on the autopay.pl website, the firm wrote that it had become the target of a cyberattack. So far, as it said, it has not confirmed that the data was copied or used, but “it cannot completely rule this out”, which is why it is directly informing customers whose data may be affected.
Immediately after detecting the incident, the company blocked the unauthorised access, secured its system and introduced additional monitoring mechanisms.
Reports to institutions
According to Autopay, the incident was reported to the President of the Personal Data Protection Office (UODO), the police and CSIRT KNF, the incident response team operating at the Polish Financial Supervision Authority (KNF). The company declares that it is cooperating with these institutions to clarify the matter. As of publication, we have not found a separate statement from the UODO, the police or the KNF on this case.
The statement does not specify exactly what data may have been covered by the incident, how many customers or transactions are affected, or whether the data includes information about payment cards.
Recommendations for customers
Autopay advises regularly checking transaction history and promptly reporting to the bank any operations that were not made by the customer. The firm also asks for caution regarding messages and calls referring to this incident, as this is a typical scenario for fraud attempts following data leaks. People whose data may be affected are to receive direct information from the company with specific steps to reduce the risk.
What Autopay does
Autopay is a Polish fintech serving the financial, telecommunications and e-commerce sectors. Its solutions are used, among other things, for online payments, instant transfers, phone top-ups and motorway tolls, which is why many Poles may have used its services, often without realising it, when paying in online shops.
The company says its priority is the security of its customers and a full explanation of what happened.
