178,000+ Invoices Expose Customer Data from Invoicely Platform

A significant data exposure incident has affected the cloud-based invoicing platform Invoicely, exposing customer data worldwide. The exposed database contained 178,519 files in formats such as Excel, CSV, PDFs and images, and the system was not password-protected or encrypted, making it accessible online.

Invoicely’s owner, Stack Holdings GmbH, is identified through the database contents, and the disclosure followed responsible reporting protocols when cybersecurity researcher Jeremiah Fowler alerted the company and they restricted public access within hours.

The data included invoices with personally identifiable information, including names, physical addresses, phone numbers and tax identification numbers, plus airline tickets, ride-sharing receipts, health insurance records and military or medical payment information.

The article notes uncertainty around how long the database was publicly accessible or whether unauthorised parties accessed it before Fowler’s discovery, and it emphasises the ongoing risk of invoice fraud and identity theft tied to leaked financial documents.