178,000+ Invoices Expose Customer Data from Invoicely Platform

A significant data exposure incident has affected the cloud-based invoicing platform Invoicely, potentially compromising sensitive information belonging to customers worldwide.

The exposed database contained 178,519 files in various formats including Excel spreadsheets, CSV files, PDFs, and images. Most concerning was the complete lack of security measures – the database was neither password-protected nor encrypted, making it accessible to anyone who discovered it online.

Fowler’s investigation revealed invoices containing personally identifiable information such as names, physical addresses, phone numbers, and tax identification numbers belonging to service providers, partners, employees, and customers across multiple countries.

Beyond standard business documents, the database also housed airline tickets, ride-sharing receipts, health insurance records, and medical payment information.

Screenshots from the discovery showed scanned checks complete with nine-digit routing numbers, account numbers, and check numbers, highlighting the severity of the financial data exposure.

Cybersecurity researcher Jeremiah Fowler discovered an unprotected database containing nearly 180,000 files, including invoices, banking information, tax documents, and other confidential records.

The database and its contents indicated ownership by Invoicely, operated by Stack Holdings GmbH, a Vienna-based software company. Following responsible disclosure protocols, Fowler immediately contacted Invoicely through their support system.

The company responded quickly, restricting public access to the database within hours of notification, though they did not provide any official response to the disclosure.

Quarter Million Businesses

Invoicely provides cloud-based invoicing and billing services to businesses worldwide, offering tools for creating estimates, automating recurring billing, sending payment reminders, and tracking expenses and mileage.

The platform operates on a freemium model with limited free accounts and paid tiers offering expanded features. Available on both iOS and Android platforms, Invoicely serves more than 250,000 businesses according to their LinkedIn profile.

The exposure timeline remains unclear – neither how long the database was publicly accessible nor whether unauthorized parties accessed the information before Fowler’s discovery.

Additionally, it’s unknown whether the database was directly managed by Invoicely or a third-party contractor, information that would require an internal forensic audit to determine.

Invoice Fraud Threatens Organizations

This incident occurs amid rising concerns about invoice fraud, with the 2024 AFP Payments Fraud and Control Survey revealing that 80% of organizations experienced payment or invoice fraud attempts in 2023 – a 15% increase from the previous year.

Exposed invoice data provides criminals with detailed information about business relationships, payment processes, and financial accounts that can be weaponized for sophisticated fraud schemes.

The leaked tax documents present additional risks, containing Social Security numbers, dates of birth, and employer details that enable identity theft.

The IRS estimated that approximately 6,000 fraudulent tax returns were filed using stolen identities during the 2025 tax season, with authorities blocking $54 million in fraudulent refunds.

For organizations managing sensitive financial data, security experts recommend implementing encryption for all stored information, conducting regular vulnerability assessments, and maintaining continuous monitoring systems.

Businesses and individuals potentially affected should change passwords on related accounts, monitor credit reports for suspicious activity, and verify any unexpected payment requests through official channels before processing.

The incident underscores the critical importance of securing cloud-based business platforms, particularly those handling financial and personal information for hundreds of thousands of users worldwide.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.