Identity and Secure Access

Autopay: attackers used legitimate credentials and administrative tools – no typical alerts

On November 11, 2026, Autopay detected unauthorized access to parts of its infrastructure and payment data. According to information provided by the company to Sekurak, the attackers performed most actions using legitimate credentials and administrative tools; each individual step appeared to be routine administrative work.

  • SourceAutopay S.A.
  • Source publicationNovember 13, 2026
  • TypeThreats and incidents

What happened

Incident. In a statement dated November 13, Autopay reported that on November 11, it identified unauthorized access to its infrastructure and a portion of payment-related data. The company blocked access, secured the system, and reported the incident to the President of the Personal Data Protection Office (UODO), the Police, and CSIRT KNF. While data exfiltration or misuse has not been confirmed, the company stated it cannot be entirely ruled out.

The attack according to Autopay. Details were shared with Sekurak on the evening of November 13 during a call with the Security Manager and via an official email. Attackers moved between zones through systems trusted by default: monitoring, CI/CD, deployment automation, and password management. Workstations were not targeted. Individual steps did not trigger typical alerts.

AI angle. Autopay also claims to have evidence of AI-supported automation: series of operations on dozens of resources within seconds, path changes after each block, and tools written specifically for the company’s environment. Sekurak notes that this is the company’s account, not independently verified findings.

Key findings

  • November 11, 2026 – incident detection; November 13 – company statement and reports to UODO, Police, and CSIRT KNF.
  • According to Autopay, most actions were performed using legitimate credentials and administrative tools.
  • Attack path: monitoring, CI/CD, deployment automation, and password management – without infecting workstations.
  • The company invalidated credentials, isolated and rebuilt compromised servers, and is rotating keys with partners. A description of the perpetrators’ tactics was provided to CSIRT KNF for sector-wide distribution.
  • Autopay did not disclose how attackers obtained the credentials or what specific data may have been leaked.

Why it matters

SafeWave CommentaryWhen an attacker logs in with a valid account and uses admin tools, a single event carries no suspicion. The risk lies in service accounts and the permissions of trusted systems: CI/CD, monitoring, and password vaults. For the financial sector, this is a DORA issue; for essential and important entities, NIS2 and Poland’s KSC Act. Recommended actions: audit service account inventories and their permissions in these systems; enforce MFA and short-lived credentials for all administrative access, including technical accounts; implement behavioral analysis that correlates events across multiple systems rather than relying on isolated alerts; ensure automated token invalidation and host isolation within minutes; in the financial sector – verify if the CSIRT KNF advisory describing the perpetrators’ tactics has reached the security team. We work with Silverfort and Exabeam in these areas. More: Identity and Secure Access.