Poland's largest convenience chain Żabka Polska hit by cyberattack, data listed for sale

Żabka Polska, the largest convenience-store chain in Poland, has confirmed a cybersecurity incident involving unauthorized access to parts of its network, while a threat actor separately markets data it claims was stolen from the company. A spokesperson for Żabka told Cybernews the company learned at the end of last week of suspected unauthorized access to selected technical resources, reached through an external service provider, and that the access was detected and blocked under the company’s established security procedures.

"Based on the initial company’s findings, the security of transactional data and the continuity of our business operations have not been compromised," the spokesperson said.

Żabka said the matter was escalated to the company’s Data Protection Officer and reported to Poland’s Personal Data Protection Office, known as UODO, in line with legal and internal requirements. "Individuals whose personal data may have been affected by the incident are being informed on an ongoing basis. The security of our data and systems remains our highest priority. From the outset, we have focused on swift response measures, full cooperation with the relevant authorities, and transparent communication with individuals who may have been impacted by this situation," the company said. Żabka added that it continues to monitor the situation and is taking steps to further strengthen the security of its systems and infrastructure.

Separately, an account using the name Lumia is advertising the data on a marketplace hosted on one of several mirrors of the Breach Forums site, asking 5,000 euros for what it describes as the complete dataset. The seller claims to have pulled internal employee records, confidential project documentation, source code and credentials for production systems, and has posted a sample of the material.

According to the seller’s claims, the haul includes full names, corporate email addresses ending in @zabka.pl, JIRA usernames, account IDs and employee or contractor directory information drawn from roughly 541,000 JIRA issues, along with 2.7 million user references spanning more than 20 vendor domains, including Accenture, Netguru, Onwelo, BlueSoft and Sygeon. The seller also claims the material includes JIRA exports tied to IT service desk operations, totaling nearly 230,000 tickets, as well as records from the Nowa Kasa point-of-sale system, the ZSS sales system, the Cyberstore platform, the zMarket order and inventory management system, and the SAP ERP platform along with its MDG data governance module.

The seller further claims to have copied 89 internal source-code repositories holding close to 12,000 files covering Żabka’s retail platform, backend microservices, front-end applications and other infrastructure, along with credentials for production systems. Those credentials allegedly include GitLab personal access tokens reused across the compromised repositories, database administrator passwords, environment files with hardcoded tokens, and patterns describing direct SSH access to individual store servers. The listing also claims to contain roughly 4,000 unverified references to bank accounts, along with retail operations data and details of vendor relationships.

Cybernews security researcher Rasa Jurgutyte examined the data samples, contained in a 3.1-megabyte ZIP file, and said the exposed JIRA tickets appear consistent with genuine company records based on their format, content and use of Polish-language comments. The sample included 48 JSON files, each representing a separate internal JIRA project with accompanying issue records, plus 89 additional files containing GitLab references, including samples from main code branches and an OAuth2 key exposed as a URL parameter.

"Exposed blueprints of infrastructure, credentials, and potentially source code are significant enough to enable attackers to exploit known vulnerabilities and move laterally," Jurgutyte said.

Żabka operates 13,063 stores across Poland and Romania and handles 4.3 million transactions daily, according to the company’s own "About Us" page, which also reports sales to end customers of 31.1 billion Polish zloty, or about $8.34 billion, in 2025.