KSeF is dangerous, even if he didn't usage Imperva!

niepoprawni.pl 3 weeks ago

Access to all invoices of the Polish economy through KSeF has 3 abroad interviews, due to the fact that the safety gateway of this strategy is operated in the cloud by the American company Imperva, owned by the military-intelligence French group Thales, and analytical servers are in Israel. Nevertheless, even if this company was resigned and the goal service was given to the Polish company, KSeF would inactive be very dangerous!

KSeF has an anonymous invoice search function. It allows you to download any paper in XML format (extended tag language, i.e. standard text format) or PDF (portable paper format), without having to log in and prove that we have the right to do so. According to the regulations, for the strategy to issue us an invoice, it is adequate to enter 5 information on the form on the website: paper number in KSeF, average invoice number, buyer NIP number, name and full amount to be paid.

Computer threats and data dissemination

A real threat arises erstwhile a hacker, malicious software, or disloyal worker takes over the ready-made compilation of specified data. This information is massively processed in places that are guarded much little than corporate servers with financial documents, which generates a number of circumstantial attack vectors!

Regular spreadsheet as a password magazine

Files specified as Excel or CSV (a format that stores values separated by a comma) with a list of monthly costs are treated by employees like tables whose leakage is not dangerous. However, if they contain these 5 fields, they become a collection of access keys. Spying software does not request to bargain gigabytes of invoices — it is adequate that it sends a tiny text file unnoticed, and the attacker takes the first invoices from the government.

Avoiding corporate rights

Large ERP systems (company resource planning software) and BI tools (Business Intelligence, or business analyst) are configured to let the analyst to see only general amounts and numbers, without a right to see precisely what was purchased. However, if these general data are adequate to anonymously collect the invoice from the Ministry, the company's interior safety features are no longer relevant.

Unable to change password after dismissal

When a company releases an employee, it can cut off access to an interior VPN (a virtual private network, i.e. a safe encrypted connection) or block a postal account. However, the historical invoice, NIP and quota numbers cannot be changed. If an worker has already copied a table with specified metadata, his access to these papers never expires.

Risk concentration of partners

Accounting offices and accounting software developers process the data of millions of documents, including metadata listed at the beginning. Taking over an account in specified a company opens the way to invoices of hundreds of independent companies.

Risks in support departments

Helpdesk consultants (technical support) frequently ask customers to give a incorrect invoice number, KSeF number, NIP number or amount to diagnose the problem. Thus, ticket retention systems (virtual bug reports) collect data sets allowing access to full invoices, and a number of employees and external subcontractors have access to them.

Logs and outdated backups

Technical records from the programs are sent to logs monitored by SIEM systems (information management and safety events) and APM (app performance monitoring tools). Even if the company perfectly protects current documents, the attacker can bargain an old backup (a backup) from a fewer years ago, where metadata are little protected and then download current invoices from KSeF.

Blind defence systems

DLP software (data leakage prevention system) will block the effort to send a package with ready-to-use XML or PDF files by e-mail, but will pass a simple text table, recognising it as a non-threatening report.

Economic espionage and fraud

Metadata only says Company A paid B a certain amount. However, the full invoice reveals circumstantial products, precise quantities of goods purchased, discounts obtained and peculiar conditions. Access to specified information allows for powerful abuse in the business world.

Absolute economical Interview

The competitor can check that the equipment that costs PLN 100 1000 in the catalogue is actually sold to a large client for 64 thousand. Knowing the real costs and the full structure of rival suppliers, you can perfectly calculate your own bid in a tender, subcontract key subcontractors or completely reconstruct its supply chain.

Risk to infrastructure and exchange

Analysis of abrupt purchases of specialized parts (e.g. transformers, valves) can betray failures or plans for modernization in power plants or refineries. Similarly, the mass procurement of legal and geodesic services in 1 region exposes plans for giant investments by listed companies long before their authoritative announcement.

Perfect BEC and Phishing fraud

Criminals usage authentic data for BEC attacks (Business Email Compromise, or fraud with acquisition of corporate correspondence) and phishing (information fraud). A message requesting a change in the account number for the deposit, in which the number of the peculiar invoice, the name of the goods, the amount per cent and the supplier's data agrees, puts almost all worker to sleep.

Personal data leak and economical mapping

Since invoices besides apply to persons conducting single-person business activities, mass leakage of metadata becomes a violation of the GDPR. From a large collection of collected papers it is possible to build a detailed graph of links of the full Polish economy, and the state strategy will only evidence IP numbers (Internet Protocol, which means unique addresses of devices on the network), without the anticipation to indicate who specifically downloaded the files.

Anonymous access is forced by law!

The invoice access mechanics itself without authentication is not an accidental part of KSeF developers. Its existence derives straight from the VAT Act, which provides for access to the invoice without authentication and authorises the Minister of Finance to find the data needed for specified access. The Decree of the Minister of Finance and Economy of 12 December 2025 determined that these would be: KSeF number, invoice number, buyer ID, name and full amount of receivable. So the problem is primarily legislative! The legislator consciously predicted the way without authentication, and the administration decided that the function of certification of access would be performed by the invoice itself.

As long as the current rules are in force, companies must completely change their approach to protecting their information. Each report, sheet or email containing a KSeF number, invoice number, buyer data and amount must be protected precisely the same as access to the bank account. This requires setting up systems to prevent leakage, clean up unnecessary data from analytical databases and make employees aware that in today's realities a simple study in a simple table can be the key to the most crucial secrets of their business.

Grzegorz GPS Swiderski
]]>https://Twitter.com/gps65]]>
]]>https://t.me/CanalBlogeraGPS]]>

PS. Sources of this plagiarism: