Żabka Polska Cyberattack Exposes Employee Data and Source Code for Sale

Żabka Polska, Poland's largest convenience store chain, confirmed a cyberattack involving unauthorized access to its network. The breach was detected through an external service provider, and the company reported that transactional data and business operations remain secure. However, a threat actor is advertising a dataset for €5,000, claiming it includes internal employee records, confidential project documentation, source code, and credentials for production systems. The compromised data reportedly includes full names, corporate email addresses, JIRA usernames, and details from over 541,000 JIRA issues. The seller also claims to have accessed 89 internal source-code repositories and various operational system records, including those from point-of-sale and inventory management systems. Żabka is cooperating with authorities and has escalated the matter to its Data Protection Officer. The company is actively monitoring the situation and enhancing its security measures.

Key Points: • Żabka Polska experienced a cyberattack with unauthorized access to its network. • A threat actor is selling a dataset for €5,000, claiming it includes sensitive employee and operational data. • The breach affects multiple systems, including JIRA, point-of-sale, and source code repositories.