Attack on Żabka: what was leaked and is your data safe?

As a result of a hacker attack on the Żabka chain, employee data and sensitive information of app users were leaked, including e-mail addresses, phone numbers, and detailed purchase history. Customers should immediately change the passwords to their Żabka app accounts to minimize the risk of account takeover and identity theft. These actions are necessary, as the disclosed databases enable criminals to conduct precisely targeted phishing attacks.

Course of the attack: Chronology of events

The first signals regarding the breach of Żabka's IT systems reached the public on Monday, August 3, 2026. News outlets, including TVN24, Onet, and Spider’s Web, reported almost simultaneously on the incident affecting one of the largest retailers in Poland. The chain, managing over 10,000 locations, found itself at the center of an image and operational crisis. Hackers, without waiting for a corporate response, openly declared they had seized the databases. This information was confirmed in the following hours by the editorial teams of Money.pl and CRN Polska.

By August 4, 2026, "Rzeczpospolita" described details regarding the actions of cybercriminals who were actively boasting about their loot on closed forums. Putting stolen databases up for sale is a standard mechanism aimed at the quick monetization of obtained information. In this specific case, alongside employee data, the hackers focused on the databases of mobile app users.

It was not until August 5, 2026, that the Ministry of Digital Affairs took an official stance, which was noted by Radio ESKA and Super Biznes. The ministry confirmed that it is monitoring the data protection process and treats the incident as a high-priority case. The ministry's involvement clearly indicates that the scale of the leak is not limited to a few random records. It concerns a data structure of immense importance for the operational stability and privacy security of millions of Poles using the Żabka loyalty app.

Who is affected by the leak? Employee and customer data

Confirmations arriving since August 3 point to two main groups of victims. The first are the chain's employees, whose personal data, including contact details and logins, fell into the hands of criminals. The second group consists of mobile app users. This app collects not only login data but also transaction history, shopping preferences, and information about the number of accumulated "żapps" points.

The key risk for the customer lies in the phenomenon of so-called credential stuffing. If a user used the same password in the Żabka app as in other services, hackers may gain access to their e-mail, social media, or banking services. This mechanism involves automatically testing stolen login-password pairs across thousands of popular websites.

How to check what is happening with your account? The most effective tool is the HaveIBeenPwned.com service. After entering the e-mail address associated with the Żabka app, the system will search databases leaked from various services. Although the Żabka database may not be indexed in this tool immediately, it is the best way to verify whether a given e-mail address has already been subject to attacks.

Users should also verify the status of their account in the app themselves. To check login history and point activity, go to the "Settings" tab in the app, and then proceed to the "Profile" section. There, you can view the data assigned to the account. If you notice unusual data or activity that you do not recall, change your password immediately and remove any payment methods. The lack of full corporate transparency in the first hours after the attack forces an attitude of limited trust. Every hour that we do not change our password is time for criminals to use stolen sessions or login data.

Security perspective: Why is the Ministry of Digital Affairs reacting?

The Żabka data leak has become a matter of national security. The Ministry of Digital Affairs, by joining the monitoring of the incident, sent a signal that the leak is considered a real threat to citizens' privacy. Monitoring the process of securing systems by private entities is a standard procedure in such situations, aimed at protecting personal data on a mass scale.

For the end-user, this fact means that the matter is not just an internal problem of the retail chain's IT department. If the Ministry of Digital Affairs is getting involved, it means that potential damages could be severe for thousands of people. State services are scrutinizing the case, but the responsibility for individual digital security still rests solely with the user.

One cannot count on automatic security systems to fully protect an account from the effects of a leak. Hackers, possessing a database, can conduct phishing attacks, impersonating Żabka customer service. If you receive an e-mail or SMS with a link to "reset your password" after the attack, stay vigilant. Official communications should be verified directly in the app, not by clicking on suspicious links in messages.

Effects of the leak: Costs and consequences for the chain

The scale of the breach into Żabka's systems goes beyond purely technical challenges. The chain must prepare for long-term financial burdens. The costs of security audits, hiring external expert firms to investigate the breaches, and potential fines imposed by supervisory authorities are a real threat.

The threat does not end with expenses for infrastructure improvement. The chain faces legal consequences, including fines for GDPR violations. Supervisory authorities do not show leniency in such situations, and the amount of the fine can be calculated as a percentage of the company's global turnover. This is a financial risk that the board cannot ignore.

The most painful cost remains the loss of trust. For a company basing its business model on a mass mobile app, reputation is a key asset. A user who feels their data is at risk often stops using the services. Rebuilding a tarnished image will take months, or even years. Żabka is losing more than just data; it is losing the sense of security that was the foundation of the loyalty of millions of Poles.

The retail market facing the threat

The attack on Żabka is a warning signal for the entire retail sector in Poland. Cybercriminals are increasingly choosing large retail chains as targets because they possess huge user databases, often less secured than those of financial institutions. Even after patching the hole in the system, stolen data can be used for phishing attacks against customers for a long time.

Data in the Żabka app is not just a login and password. It is also the history of locations of stores where we shop, which allows for the building of precise consumer profiles. A leak of such data is a powerful tool in the hands of fraudsters, who can create credible social engineering campaigns. Every image stumble of Żabka can be exploited by other retail chains. This forces the board to take decisive actions to regain credibility, which, however, does not change the fact that for the average user, digital hygiene is now the most important thing.

Questions and answers

Do I need to delete the Żabka app?

There is no need to delete the app, but it is crucial to immediately change your password to a stronger and unique one. If you suspect that your data has been compromised, remove the payment method linked to the app until the matter is clarified.

What data could have been leaked from the app?

There is a risk that hackers obtained login data, purchase history, and data associated with the user account in the app. It has not been confirmed that full payment card data was leaked, but you should monitor bank statements for suspicious transactions.

Is my money in the app safe?

If you use payment features in the app, exercise extreme caution. In case of noticing unauthorized transactions, immediately report this fact to your bank and the payment operator.

Why is the attack on Żabka so significant?

From the point of view of digital security, Żabka is a "contact point" for millions of Poles. Any data leak from such a widely used app poses a systemic risk, affecting the security of other user accounts if they follow the rule of password repetition.

What should I do if I used the same password in other places?

Change your password in every service where you used the same set of login credentials as in the Żabka app. Use a password manager to generate unique and hard-to-crack character strings for each service separately. This is the only effective protection against credential stuffing attacks.

Does the Ministry of Digital Affairs provide a list of victims?

The Ministry does not maintain a public list of victims. Information about the leak is provided mainly by the media and official company communications. Follow announcements on the cert.pl website, where warnings about the latest threats in the Polish network are published.

Do hackers have access to my loyalty points?

Yes, if hackers gained access to the account, they can use accumulated points or use them for purchases, provided the app allows their redemption without additional authorization. Check the point usage history in account settings.

When will the situation be fully under control?

The situation will be under control when the company completes the security audit and implements additional security measures, such as mandatory two-factor authentication (2FA) for all users. Until then, remain maximally vigilant.

In the face of such an extensive incident, users should not wait for official company instructions, which are often delayed. The security of one's own data requires proactivity. Every user who ignores the issue of changing their password becomes a potential target, and in the era of the digital economy, personal data is a currency that hackers gladly exchange for the real financial losses of their victims. This situation also requires attentiveness in tracking bank communications, as stolen phone numbers and e-mail addresses form the basis for creating increasingly credible SMS messages, pretending to be notifications from financial institutions or couriers.

It is worth remembering that even if a company claims the situation is under control, the user is the last link that can effectively stop an attack. No corporation will recover lost funds from your bank account for you if the password to it was the same one that leaked from the Żabka database. That is why it is so important to start the process of securing your data from the most sensitive points, such as e-mail and payment apps. A security audit of your own account is an activity that will take a few minutes and may save you from months of fighting to regain your digital identity.

Regardless of the further steps taken by the Żabka chain, this case serves as a brutal lesson for all users of loyalty apps. Excessive trust in systems that collect such detailed information about us as purchase history or location is the greatest weakness that hackers can ruthlessly exploit. Do not wait for further announcements — act now, because in cybersecurity there is no room for errors, and the effects of this leak will be felt on the network for a very long time. Everyone who uses the app must now take on the role of guardian of their own data, because in a clash with a professional hacker group, it is the individual vigilance of the user that is the only effective barrier separating us from serious financial and legal problems.