Autopay hit by cyberattack as firm cannot rule out payment data theft

Autopay, a Polish platform for automating cashless payments, has reported a security incident. The company found unauthorised access to its infrastructure and to part of the payment data it processes. According to its statement, it has not confirmed that this data was copied or used, but it cannot rule that out completely. For that reason, Autopay is contacting customers whose data may be affected directly.

What is known and what is not yet

The company has not described exactly what data may have been exposed, and it has not given the number of people affected. Spider's Web notes that there is currently no basis for claiming that the attackers obtained card numbers, security codes or online banking passwords.

The incident has been reported to the President of the Personal Data Protection Office, the Police and CSIRT KNF, the team that responds to security incidents in the financial sector. According to the information provided, the company blocked the unauthorised access, invalidated passwords and other credentials, and isolated the affected servers. Services whose availability was limited have been restored to full operation. Autopay also says that customers' money is safe.

The role of artificial intelligence

Spider's Web, citing information Autopay passed to the Sekurak website, describes the attack as highly automated. The company believes the attackers most likely used language models. According to that account, the intruders moved through the infrastructure using trusted credentials and administrative tools, so individual actions may not have triggered typical alerts. These details come from a secondary report rather than the official statement, so they should be treated with caution.

What this means for you

The sources do not indicate that the incident affected users living in the United Kingdom. People who use Autopay should still keep an eye on their transactions. The company recommends checking transaction history regularly and reporting to your bank, as soon as possible, any payments you did not make.

Autopay also warns about messages and phone calls that refer to this incident. Spider's Web argues that such contact may now be the most direct threat, because a fraudster does not need to convince the victim that something has gone wrong. Referring to a well-publicised attack is enough to pose as a company or bank. Messages urging you to log in or share details urgently should be treated with great suspicion.