2invoice 2024 Alleged Data Exposure

A sidecar in the reviewed sealed archive names the same domain and operator, while LeakedSource records an event for the same domain and year. These bindings associate the archive with the event at high confidence. No operator, regulator, or other official incident notice was located, so the record remains unverified.

Public and source metadata conflict on the exact month and count. LeakedSource reports June 2024 and 242,221 records in structured metadata, but July 2024 and about 1.8 million users in its narrative. The distributor sidecar claims 16 July 2024, 328,262 unique emails, and 1,835,864 client lines including the header. The source's primary client table actually contains 1,835,863 logical data records excluding its header; this is only a source-row measure for the reviewed version. The exact affected-person count is left unset. The 324,646 figure is a lower bound of independently validated unique email identifiers from explicit email fields. The 1 January date represents the year 2024 only; month precision is not claimed.

All 164 archive members were inventoried. Across 27 CSV tables with source-authored email headers, 7,719,076 logical rows were scanned and 1,343,699 valid occurrences reduced to 324,646 unique canonical emails. A further 134 members were evidence-backed as empty or lacking an email field. Three members remain explicit debt, two auxiliary text files and one parser-error CSV whose header has no email field, so coverage is PARTIAL. Only complete cells under email, default_from_email, from_email, to_email, receipt_from_email, payer_email, and receiver_email are imported. Passwords, government identifiers, names, phone numbers, addresses, and every other field are excluded. An email match alone does not prove that a person used the service or that another field belongs to the same person.