Żabka confirms cyberattack on franchise system; hackers sell data for €5,000

What happened

Żabka, Poland's largest convenience store chain with around 13,000 franchise locations, detected unauthorized access to its technical resources used for information exchange between the franchisor and franchisees late last week. The breach was carried out using an account belonging to an external service provider. The company said the access was immediately blocked under its security procedures. The incident was reported to the Data Protection Officer at Żabka Polska, the President of the Personal Data Protection Office (UODO), and specialized law enforcement agencies.

The unauthorized access was detected and immediately blocked in accordance with applicable security procedures.

The company stressed that transactional data, consumer services, and the Żappka loyalty app remained unaffected. Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski confirmed on Tuesday that the incident did not compromise customer data or store operations.

Data leak and hacker activity

On Monday evening, the cybersecurity portal Niebezpiecznik reported that hackers had stolen personal data of employees and partners with access to Żabka's infrastructure. The attackers offered the data for sale on a cybercriminal forum for €5,000, a sum the portal described as "ridiculously low." They also emailed news of the breach to Żabka's contractors and journalists, an unusual move that drew attention to the incident.

A sample of the stolen data indicated the attackers had access to the company's Jira system, used for project management and technical ticket handling. The leaked information likely included names, email addresses in the @zabka.pl domain, and Jira user IDs of employees and contractors. Among the partners named in the communications were Accenture, Netguru, Onwelo, BlueSoft, and Sygeon. The breach may also have exposed project documentation from IT and service desk departments covering cash register systems, sales platforms, warehouse management, and ordering systems.

Store disruptions

On Sunday, August 2, customers and employees reported errors in discount calculations at Żabka stores. Some locations also experienced non-functioning payment terminals. The company acknowledged the glitch and said it was resolved in nearly 90% of stores by the afternoon. Żabka has not confirmed whether the Sunday disruption is linked to the cyberattack, stating only that a technical analysis would follow.

Official response and next steps

Gawkowski praised the company's rapid response, noting that not every cybersecurity incident means a customer data leak or operational paralysis. He highlighted cooperation with CERT Polska and the Central Bureau for Combating Cybercrime (CBZC). The minister also reminded the public of basic cybersecurity practices: using strong, unique passwords, enabling two-factor authentication, avoiding suspicious links, and verifying unexpected messages.

In Żabka's case, the unauthorized access was quickly blocked and security procedures were launched, along with cooperation with relevant institutions - including CERT Polska and CBZC.

Żabka said it is working with institutions and experts to clarify all circumstances and implement measures to reduce the risk of similar incidents in the future.

Corporate context

The cyberattack comes at a sensitive moment for Żabka. On Friday, Canadian convenience giant Alimentation Couche-Tard, owner of Circle K, announced a tender offer for 100% of Żabka Group shares. The move follows the withdrawal of Japan's 7-Eleven from earlier negotiations. The breach adds a layer of uncertainty as the ownership transition unfolds.