On 17 September 2026, the French software publisher Zenfirst, which provides treasury and invoicing software for businesses and freelancers, was targeted by a data breach claim signed by an attacker calling themselves "Alduin". The claim covered the data of around 4,400 users and prospects, as well as entire invoices: names, email addresses, phone numbers, company information, Stripe identifiers and the detailed content of accounting documents. According to the first technical findings, access was made possible by the compromise of an account without two-factor authentication (source: fuitesinfos.fr, 17 September 2026).
Why this incident comes at this particular time
This is not a coincidence of timing. Since 1 September 2026, all companies subject to VAT in France have been required to be able to receive electronic invoices, whatever their size. Large companies and intermediate-sized companies also have to issue them (source: impots.gouv.fr, 2026). This reform, led by the Directorate General of Public Finances, has led thousands of companies to choose a Partner Dematerialisation Platform, or PDP, registered with the tax authority.
PDPs have now become concentrators of financial data of unprecedented sensitivity. They no longer store only customer identifiers: they host complete invoicing flows, with amounts, supplier names, contact details, payment information and bank references. A publisher such as Zenfirst, even if it is not registered as a PDP in the strict sense, processes a volume of data that belongs to the same functional category. The reform has mechanically increased the value of the data hosted by these players, and therefore their attractiveness to attackers.
What the incident reveals about your GDPR obligations
For companies using Zenfirst, the question is not only whether their data has been exposed. It is to understand their position in the chain of responsibility. In the typical relationship between a management software publisher and its customers, the publisher acts as a processor within the meaning of Article 28 of the GDPR: it processes personal data on behalf of the controller, which is the customer company.
If Zenfirst is your processor, two obligations apply to you directly. The first is to check whether your contract with Zenfirst contains the processing clauses required by Article 28: an obligation to notify incidents within a timeframe that allows the controller to meet its own obligation to notify the French data protection authority (CNIL) within 72 hours of becoming aware of the breach. The second is to determine whether the exposed data concerns your own customers or employees. If so, you may be facing a personal data breach that must be notified to the CNIL and, if the risk to individuals is high, communicated to the data subjects.
Notifying an incident that involves a processor is a common cause of missing the 72-hour deadline: the controller waits for the processor to confirm the actual extent of the leak before acting, and the deadline expires during that wait. The coordination between your GDPR and NIS2 obligations in this type of scenario is covered in our article on coordinating notification deadlines for a shared incident.
The NIS2 angle: is your PDP an important entity?
The transposition of NIS2 into French law, expected through the Resilience Bill, places providers of essential digital services within the scope of important or essential entities, depending on their size and sector. A billing software publisher or a PDP that processes financial flows for thousands of companies may fall into this category, in particular if it provides cloud computing or data management services to entities that are themselves subject to NIS2.
If your PDP provider is an entity subject to NIS2, it must notify the French national cybersecurity agency (ANSSI) of any significant incident within 24 hours, and inform you within a timeframe that allows you to manage the incident yourself. If it is not, you cannot rely on it to trigger your incident response process. You must then rely on your own detection capability, which presupposes that you have real-time access to the activity logs of your account on the platform.
What the absence of MFA reveals about your supply chain
The technical vector identified in the Zenfirst incident is simple: an account without two-factor authentication. It is the same vector documented by the CNIL in its decision of 3 September 2026 against the Hôpital privé de la Loire, which was fined EUR 500,000 for the absence of MFA on remote access to patient data. The parallel is instructive: the absence of MFA is no longer a residual risk, it is a serious failing in the eyes of supervisory authorities.
For your financial management providers and your PDPs, your supplier assessment questionnaire should now include three specific points. First, MFA coverage: are all accounts with access to your data protected by strong authentication, including service accounts and administrative access? Second, logging: are accesses to your data recorded in time-stamped logs and kept for long enough to allow post-incident investigation? Third, contractual notification: does your contract require the provider to notify you of any security incident within a specific timeframe, shorter than the CNIL's 72 hours?
Three actions to take before the end of the quarter
The e-invoicing reform has not yet stabilised. The first weeks of application are revealing the weaknesses of the least prepared players, and incidents such as Zenfirst's are likely to multiply as the value of the data hosted keeps rising.
First action: review your register of processors. Include all the financial management and invoicing platforms that you have adopted since 1 January 2026. For each one, check that a GDPR data processing agreement exists and what it contains. A platform adopted in a hurry to meet the obligation to receive electronic invoices is not necessarily covered by your existing DPA.
Second action: verify MFA coverage at your financial management providers. Do not settle for the declared policy: ask for evidence of deployment. A publisher that cannot provide you with an MFA coverage report broken down by account type is not managing this risk seriously.
Third action: test your notification capability. If one of your processors contacted you today to report a data breach involving your customer invoices, how long would it take you to determine which individuals are affected, assess the risk and prepare a notification to the CNIL? If the answer exceeds 48 hours, you will not be able to meet the statutory 72-hour deadline.
The e-invoicing reform has created a new surface of exposure. PDPs and financial software publishers are now critical links in your data processing chain. Treating them as such in your compliance programme is no longer optional.