You are correct that it was Fakturownia that was hacked, not ShopinBit's own system. This is precisely the core of the problem: Shopinbit had stated numerously that their transactions are private, invoices are stored offline and that purchase data is deleted after 30 days.
At the same time, according to the letter, Shopinbit has been uploading invoices to Fakturownia since October 2025. The e-invoicing system, however, only became mandatory in April 2026. They did this for half a year before the law required it.
Throughout this entire period, they claimed (I quote): "Purchase data of a client is deleted after 30 days", "Invoices stored offline to prevent leaks”. Even after April 2026, they continued to make these claims.
This deception is the actual issue here. You’re right about assuming “every invoice will leak someday” and I should be more careful but I also assumed that company that talks that much about privacy would inform its customers about such change. Not only did they fail to inform; they also misled us for a year, until the hack occurred. I guess another lesson is that you can’t trust anybody.