ŻABKA REPORTS UNAUTHORIZED ACCESS THROUGH THIRD-PARTY ACCOUNT, SAYS PAYMENTS AND CUSTOMER SERVICES UNAFFECTED

WARSAW, Poland — Żabka has reported unauthorized access to internal technical systems after attackers compromised an account belonging to an external service provider connected to the Polish convenience-store chain.

The company detected the intrusion in systems used to communicate with its franchise network and moved to block the unauthorized access. Żabka said its payment infrastructure, transaction data, Żappka loyalty application and daily retail operations were not affected.

“We assure you that the security of transaction data and consumer services, the confidentiality of Żappka app data, and our operational activities remain unaffected,” the company stated.

Żabka operates one of Europe’s largest convenience-store networks. As of June 30, 2026, its Polish network included 12,823 Żabka stores supported by approximately 11,000 franchisees. The Żappka application had approximately 11.2 million users.

The size of that network gives systems used for franchise communications an important operational role. Such platforms can contain internal instructions, technical requests, business records and information exchanged between corporate personnel, contractors and franchise operators.

Żabka attributed the initial access to a compromised account belonging to an unspecified external service provider. The company’s statement indicates that the attackers entered through trusted third-party access instead of directly breaching the retailer’s primary infrastructure.

Third-party accounts can provide access to corporate systems when contractors, technology providers or support personnel require remote connectivity to perform authorized work. If those credentials or active authentication sessions are stolen, an attacker may appear to be a legitimate user until the activity is detected and blocked.

The company has not identified the external provider, explained how the account was compromised or disclosed how long the attackers retained access. It has not stated whether the account was protected by multifactor authentication or whether the intrusion involved stolen credentials, authentication tokens or an active session.

Żabka notified Poland’s data-protection authority and law-enforcement agencies after discovering the incident. Krzysztof Gawkowski, Poland’s minister of digital affairs, said authorities were informed promptly and that information supplied to the government indicated customer data, payment information and retail operations were not affected.

The breach became public after unidentified individuals advertised what they claimed was information stolen from Żabka on a cybercrime forum. The purported data was offered for €5,000, or approximately $5,800.

The attackers claimed they obtained access to internal company resources, including an environment used to manage technical projects, support requests and operational workflows. They also claimed to possess employee and contractor information, internal documentation, passwords, authentication tokens, application programming interface keys and source code associated with multiple software repositories.

Those claims remain unconfirmed. Żabka has not publicly verified the advertised data, confirmed the volume or categories of information involved, or stated that passwords, source code, tokens or application programming interface keys were stolen.

Information displayed or offered by cybercriminals cannot establish the full scope of an intrusion without validation. Samples may contain current records, outdated information, material obtained during an unrelated incident or data assembled from several sources. The company’s continuing investigation will need to determine which systems the compromised account could reach, what actions were performed and whether information was accessed or removed.

Żabka has not attributed the intrusion to a named threat actor. The company has also not disclosed receiving a ransom demand, and there is no confirmed evidence identifying the incident as a ransomware attack.

The absence of disruption to payments and store operations suggests that the attackers did not successfully interfere with systems responsible for processing customer purchases and maintaining retail services. Access to an internal communications or project-management environment can still expose sensitive business information.

Any confirmed exposure of authentication tokens, application programming interface keys or passwords would require a broader security response because those materials can provide access to other systems. Revoking active sessions, rotating credentials and reviewing connections made through the third-party account would be necessary to determine whether the attackers attempted to move beyond the original environment.

Source-code exposure could also reveal internal application structures, configuration details or references to connected services. Possession of source code does not automatically provide access to operational systems, but embedded credentials, development secrets or uncorrected weaknesses could create additional risk if present.

The investigation must also establish whether the compromised account held permissions beyond those required by the service provider. Restricting outside accounts to specific systems and duties can limit the damage caused when a trusted identity is compromised.

Żabka’s confirmed findings remain limited to unauthorized access through an external provider’s account and the involvement of technical systems supporting franchise communications. Claims concerning employee information, internal documents, passwords, tokens, software keys and source code remain allegations made by the attackers unless the company or investigating authorities confirm them.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE