What happened at Żabka?
Poland’s largest convenience store chain, Żabka, confirmed on Tuesday that attackers broke into its internal systems. The entry point? A third-party contractor’s account, not Żabka’s own infrastructure.
The company says it spotted the unauthorized access late last week and immediately blocked it. But the damage may already be done — hackers are now advertising what they claim is stolen Żabka data on a cybercrime forum for €5,000 ($5,800).
Żabka operates more than 12,800 stores across Poland. That’s a lot of ground to cover, and a lot of potential exposure.
What data did the attackers get?
According to Polish cybersecurity outlet Niebezpiecznik, the hackers posted samples of the allegedly stolen data online. Based on those samples, the attackers appear to have accessed Żabka’s Jira environment — the internal platform used for software development, technical support, and operational workflows.
The hackers also claim to have:
- Employee and contractor information
- Internal documentation
- Passwords and authentication tokens
- API keys
- Source code from multiple GitLab repositories
That’s a serious haul if true. But Żabka hasn’t confirmed the nature or volume of any stolen data. The claims remain unverified.
What Żabka says about the breach
In its official statement, Żabka was quick to reassure customers. Payment systems, transaction data, the Żappka loyalty app, and day-to-day store operations were all unaffected, the company said.
“We assure you that the security of transaction data and consumer services, the confidentiality of Żappka app data, and our operational activities remain unaffected,” the statement read.
Poland’s Minister of Digital Affairs, Krzysztof Gawkowski, backed that up. He said on Tuesday that authorities were informed promptly and that, based on government information, the breach did not affect customer data, payment information, or retail operations.
How did the attackers get in?
The key detail here is the attack vector. Żabka says the attackers compromised an account belonging to an unspecified external service provider. They didn’t breach Żabka directly.
That’s a common pattern in modern cyberattacks. Third-party vendors often have access to a company’s systems, and if their security is lax, they become the weak link. This is a third-party account breach that should worry any business relying on external contractors.
Żabka didn’t attribute the attack to a specific threat actor and didn’t say whether a ransom demand was made. The company also didn’t respond to requests for comment.
What happens next?
Żabka has notified Poland’s data protection authority and law enforcement agencies. That’s standard procedure, but it doesn’t tell us much about what’s actually at stake.
Niebezpiecznik reported that the attackers contacted journalists and companies working with Żabka to publicize the breach before advertising the data for sale. That’s an unusual tactic — it suggests the hackers are more interested in reputation damage than a quiet payout.
For now, customers should keep using the Żappka app and paying in stores — Żabka insists those systems are safe. But the incident is a reminder that even the biggest retail chains can be exposed through a single compromised third-party account.
If you’re a franchisee or a business partner, it might be worth checking your own credentials and access rights. This Żabka cyberattack could have ripple effects beyond the company itself.
