Żabka Polska, Poland's largest convenience store operator, has confirmed that an intruder gained unauthorized access to selected technical resources on its network by abusing an account belonging to an external service provider. The company says the access was detected late in the week of July 27 and blocked immediately under existing security procedures, and that it has notified its Data Protection Officer, the President of Poland's Personal Data Protection Office (UODO), and specialist law enforcement. The confirmation followed a listing posted on August 2, 2026 by a newly registered account on a cybercrime forum offering an alleged full Żabka dataset for €5,000 (roughly $5,800). Source counts for the chain's footprint vary across reporting, from "more than 11,000" stores (Security Affairs) to "more than 12,800" (The Record) to "over 13K" (Cybernews). No primary-tier document (regulator filing, CERT advisory, or published company notification) is available in the current source set; Żabka's position is known only through statements given to the press.
What Happened
The first detailed public account came from Polish security outlet Niebezpiecznik on the evening of August 3, after its newsroom received a message alleging an intrusion at Żabka. Bankier.pl reports that similar emails were sent to foreign media and to some of Żabka's partner companies, and RMF24 notes the same mass-notification behavior. An offer to sell the data appeared on a cybercrime forum shortly afterward.
Żabka's press office, responding to Niebezpiecznik and separately to Cybernews, confirmed unauthorized access to technical resources supporting information exchange between the franchisor and its franchisees. "We confirm that at the end of last week, we received information regarding a suspected unauthorized access to selected technical resources within our network through an external service provider. The unauthorized access was detected and promptly blocked in accordance with our established security procedures," the spokesperson told Cybernews. The company's current investigation indicates the attacker reached an internal ticketing system used to report and manage technical problems.
Żabka states that payment systems, transactional data, the Żappka loyalty application, consumer services, and day-to-day store operations were not affected. Poland's Minister of Digital Affairs, Krzysztof Gawkowski, said authorities were informed promptly and that, based on information provided to the government, customer data, payment information, and retail operations were not affected.
Accounts differ on the human scope. Niebezpiecznik reported that personal data of employees and partners with accounts and privileges on Żabka infrastructure was exposed, and that data belonging to some customers had probably leaked as well; RMF24 carries the same characterization. Żabka and the Polish government both say consumer data is intact. Ransomnews, which reviewed the seller's sample archive before Żabka's statement was published, found no consumer data and no loyalty-program information in the sample. The customer-data question is therefore open: one specialist outlet asserts probable exposure, the company and the ministry deny it, and the only published sample review found none.
What Was Taken
The seller's claims are extensive and, as of this writing, unverified in full by any party. The listing, titled "[BREACH] Żabka Poland: Employee & Project Data Leak (August 2026)," advertises four buckets: personal data pulled from Jira, confidential project documentation, source code with infrastructure-as-code, and live production credentials. Buyers are directed to a Rambler webmail address.
The headline figures, consistent across Security Affairs, Ransomnews, TVP World, and Cybernews:
- Roughly 541,000 Jira issues. Ransomnews summed 48 Jira project exports in the sample to 541,463 issues, matching the advertised figure almost exactly.
- 229,734 IT service-desk tickets, reported as "nearly 230,000" by TVP World and Security Affairs. Ransomnews says the service-desk export hit its stated total exactly.
- Source code from 89 GitLab repositories.
- 2.7 million user references across more than 20 vendor domains, a figure carried by Cybernews and Ransomnews.
TVP World and Ransomnews add that the advertised files allegedly include employee and contractor information, internal documentation, passwords, access tokens, and infrastructure details. Ransomnews reports that a single GitLab access token appears in all 89 repository dumps, a detail with direct operational consequences if accurate.
The listing names specific internal systems: the Nowa Kasa point-of-sale platform, Cyberstore, zMarket, SAP ERP with Master Data Governance, and a Lotto integration. It also names outside vendors including Accenture, Netguru, Onwelo, BlueSoft, and Sygeon. Ransomnews attaches a firm caveat to all of it: its review is limited to files the seller published voluntarily, confirms only that those files are internally consistent with the listing's description, and does not establish that a breach occurred, how data was obtained, or that the full dataset exists as advertised. Niebezpiecznik's own examination of the sample established that the attacker had at least reached Żabka's Jira environment. Wider claims remain uncorroborated.
Why It Matters
Żabka is not a marginal target. It is one of Poland's largest retail companies, serving millions of customers daily across a franchise network in the five-figure store range. The confirmed intrusion path, a supplier account into franchise-facing technical infrastructure, is the same shape that has driven a long run of retail and logistics incidents: the attacker never touches the victim's perimeter as such, because a trusted third party already sits inside it.
The timing carries additional weight. TVP World notes the data was offered for sale two days after Canadian retailer Alimentation Couche-Tard, owner of Circle K, announced plans to acquire Żabka for $8.7 billion, but that samples suggest the attacker had access by July 29, before the deal became public. On the available evidence this reads as coincidence rather than deal-driven targeting, though it is a useful reminder that stolen internal documentation acquires extra leverage during a transaction.
The €5,000 asking price is the most analytically interesting element. Niebezpiecznik called it a "ridiculously low" price for the claimed volume. A dataset of this advertised scale, including live production credentials, would normally command far more. Low pricing paired with unsolicited emails to journalists and to Żabka's business partners suggests motives other than straightforward monetization: pressure, reputational damage, or a seller whose actual holdings are thinner than the listing implies. Defenders should not read a small number as a small incident, in either direction.
The Attack Technique
Żabka's own account is consistent across every outlet that carried its statement: the intruder used an account belonging to an unspecified external service provider to reach technical systems supporting franchisor-to-franchisee communication, rather than compromising Żabka's infrastructure directly. The company has not said how that supplier account was obtained, whether multi-factor authentication was in place, or whether a ransom demand was made. It has not attributed the attack to any named group.
The threat actor operates under the throwaway moniker "Lumia," per Cybernews, on one of the many Breach Forums mirrors. The account was registered on August 2, 2026 and posted the listing the same afternoon. Independent cybersecurity researcher Łukasz Olejnik publicized Żabka's confirmation on August 3, noting that confirming unauthorized access is not the same as confirming the seller's claims, and that neither the full scope of the incident nor the categories of copied data are established.
The technical picture that emerges, to the extent it can be trusted, is a credential-to-collaboration-platform chain: a supplier identity grants access to a ticketing and issue-tracking environment, that environment contains service-desk records and project documentation, and adjacent code repositories yield source and embedded secrets. The reported single GitLab token replicated across all 89 repository dumps is the classic amplifier in this pattern, where one static credential converts read access into broad repository access.
What Organizations Should Do
- Inventory and constrain third-party identities. Enumerate every account held by contractors, integrators, and managed service providers. Enforce phishing-resistant MFA on all of them, scope permissions to the minimum, apply time-bounded or just-in-time access, and expire accounts automatically when engagements end. A supplier account is a production identity and should be governed like one.
- Treat Jira, service desk, and Confluence-class systems as crown-jewel data stores. They accumulate credentials, architecture diagrams, personal data, and vendor contact lists over years. Apply the same access review, DLP, and export monitoring you apply to databases, and alert on bulk issue exports or unusual API-driven pagination.
- Hunt for static secrets in repositories and CI. The reported single token spanning 89 repositories is the failure mode to eliminate. Run secret scanning across all history, migrate to short-lived and scoped tokens, and rotate any credential that has ever been committed. Assume long-lived tokens found in code are already compromised.
- Rotate on the assumption of exposure, not on confirmation. Where a ticketing or code environment was reachable, rotate service accounts, API keys, SSH keys, and integration credentials for the named platform families rather than waiting for forensic certainty about which records were copied.
- Monitor for the pressure campaign, not just the leak. This actor emailed media and partner companies directly. Prepare partner-facing and customer-facing communications in advance, brief your service desk on how to handle inbound queries, and ensure suppliers know where to forward extortion or notification emails.
- Practice regulatory notification under real time pressure. Żabka's response, escalating to its DPO, notifying UODO, engaging specialist law enforcement, and contacting affected individuals directly, is the sequence GDPR demands within 72 hours. Rehearse it, including the harder decision of what to say publicly while scope is still unknown.
- Push contractual security requirements upstream. Require suppliers to enforce MFA, log privileged access, and report suspected account compromise within a fixed window. Assume any vendor with network access is a viable initial access vector and test that assumption during onboarding.
Sources: Polish convenience store chain Żabka hacked through third-party acc... | Alleged Żabka Breach Exposes Jira Data, Source Code, and API Keys -... | Żabka confirms major cyberattack | Żabka Polska, a major Polish retailer with over 13K convenience sto... | Żabka alleged data leak: 541k Jira tickets, 89 repos Ransomnews | Czy twoje żappsy są bezpieczne? Co wiadomo o cyberataku na Żabkę -... | Żabka zhakowana. Sieć potwierdza incydent bezpieczeństwa | Cyberatak na Żabkę. Powiadomiono służby