No European tech story this week was about code someone wrote badly. They were about suppliers: who owns them, who secures them, and who decides when they change. Six stories and what they mean for people who build and run software in Europe.
A Polish invoicing SaaS leaks the books of its customers
What happened Fakturownia, a Polish online invoicing service used by more than 600,000 businesses, disclosed that an attacker exploited a vulnerability and had access from early 27 September until 28 September, copying a large part of its database. By its own account, the stolen data includes password hashes, contractors' bank account numbers, invoice data, and API tokens. Customers were told to reset passwords, regenerate API keys and confirm any change of bank details by phone. Poland's finance ministry said the national e-invoicing system KSeF, which Fakturownia connects to, was not affected. Data protection and cybersecurity authorities are investigating.
Why it matters Poland has made e-invoicing through KSeF mandatory, phased in during 2026, which pushes hundreds of thousands of small firms onto SaaS tools that sit between them and the tax authority.
Take The state's platform held; the commercial layer around it didn't. That's the shape of every e-invoicing mandate: a hardened government core, surrounded by SaaS holding tokens, bank details and years of invoices in one database. Contractor bank accounts plus real invoice history is a starter kit for payment-diversion fraud, so the real damage may come later. If you integrate with an invoicing provider, treat its API key like a production credential: scoped, rotated and monitored.
Sources: The Record · Fakturownia incident notice · EY on KSeF
European police forces discover who owns their forensics software
What happened After the US Justice Department charged executives of Oxygen Forensics with concealing that the Virginia-registered company is controlled by Russian nationals through a Cyprus holding company, the fallout reached Europe. Politico found the phone-extraction tool had been bought or accredited by police in Germany, Spain, Italy, Poland, Hungary, Romania and Latvia. Romania's anticorruption directorate said it will stop using it, Latvia's state police suspended it, and on 2 October London's Metropolitan Police paused its use pending a review. Prosecutors do not allege malicious code. Separately, a RUSI report found only 10 of 27 member states have adopted the EU's voluntary 5G security toolbox.
Take Oxygen passed every procurement check because the checks asked where the company was registered, not who controlled it. The Commission's revised Cybersecurity Act, which would allow bans on high-risk suppliers in 18 critical sectors, works on the same flag-based logic. A US address and a Cyprus holding would have sailed through it too. Ownership checks are unglamorous, so nobody does them until a foreign prosecutor does.
Sources: Security Affairs · The Register · CyberScoop · The Register on RUSI
Microsoft starts switching off Exchange Web Services
What happened From 1 October, Microsoft began disabling Exchange Web Services in Exchange Online by flipping tenants' default setting to disabled. Admins can re-enable it and allowlist specific apps until 1 April 2027, when EWS is retired for good with no exceptions. Microsoft points customers to Graph, which still has some capability gaps. On-premises Exchange is not affected.
Take Retiring a 2007-era API is defensible, and Microsoft gave years of notice. But many firms are only now finding out how many integrations hang on one vendor's roadmap: CRM sync, archiving, the script someone wrote in 2014. That is the practical meaning of lock-in: not the bill, but somebody else setting your migration deadline. Pull your tenant's EWS usage report this week; the apps you don't recognise are the problem.
Source: The Register
The EU wants its own network for first responders, built by European companies
What happened On 30 September the Commission proposed an EU Critical Communication System so that police, firefighters and medical teams can keep talking across borders. National networks move from radio to 5G broadband, with the IRIS² satellites as backup and an EU hub for interoperability. The first 12 member states would go live in 2030 and all 27 by 2036. The Commission says critical components will come from European companies; Airbus, Leonardo and Frequentis took part in pilots. Parliament and Council still have to agree, and no budget figure has been published.
Take Sovereignty done properly: a concrete problem, European suppliers named, member states in control. The weakness is the timeline. A system that finishes rollout in 2036 is being designed now around 5G handsets and chipsets that Europe largely doesn't make. Spell out what "European components" means at the device and silicon level early, or the label will mean the integrator's address and little else.
Sources: European Commission · Eunews · Euronews
European VC money arrives, with a US playbook attached
What happened Headline closed a $400M fund for European seed and Series A, with an AI focus, pitching its record of helping European companies expand into the US. DIG Ventures closed a $120M third fund for European AI infrastructure; it says more than 90% of its launched Fund II companies entered the US market within 12 months. Sifted reported that the EU's €5bn Scaleup Europe Fund, managed by EQT, can back British companies even though the UK isn't an investor, and potentially US ones.
Take Last week's complaint was that European tech runs on American money. This week brought European-managed money whose pitch is still the road to America. That's rational: US enterprise buyers pay most. But the seed money Europe celebrates often funds the move to San Francisco. If CADA's procurement rules are meant to build a European cloud and software market, it would help if Europe's own funds treated that market as the prize rather than the launchpad.
Restate: the Apache Flink founders raise $20M for durable execution
What happened Berlin-based Restate, founded in 2024 by members of the team that created Apache Flink, raised a $20M Series A led by European VC Singular, with Redpoint and Capital One Ventures joining. It builds infrastructure that keeps backend workflows and AI agents running correctly through crashes and retries. The money goes to product and US expansion, including a San Francisco hub.
Take Open-source pedigree, a real distributed-systems problem, a European lead: the best kind of infrastructure story. Durable execution matters more than most agent frameworks. An agent that calls a payment API twice after a timeout is a bug with a cost attached. But it's the funds story in miniature: European engineering, European capital, and the commercial centre of gravity moving to San Francisco.
Source: Tech.eu
Quick hits
- ElevenLabs doubled its valuation to $22B in a $300M employee tender offer and opened a Brussels office. Tech.eu · TNW
- Snyk cut about 203 jobs in June, roughly 20% of staff and double first reports, UK filings show; 2025 revenue rose 11% to $309M. Tech.eu
- Blackwall (traffic filtering) became Estonia's newest unicorn at €1.03B in the TopTech ranking. Tech.eu
- Nubank said in a filing that it is not pursuing a deal with Monzo, after last week's reports of sale talks. Reuters via WHTC
- Blackfuel, a new AI inference neocloud, is the next venture from H Company cofounder Charles Kantor. Sifted
The thing nobody's saying
Europe's supplier-risk policy screens vendors by flag, and this week's damage came through the other door. Oxygen Forensics was a US-registered company with a Cyprus holding, and it passed police procurement in at least seven member states. Microsoft, which nobody would put on a high-risk list, began switching off an API that many European integrations still depend on. Fakturownia, a Polish provider, leaked customers' API tokens and their contractors' bank details. The revised Cybersecurity Act would stop none of these, because it asks where a supplier comes from, not who controls it, who secures it, or who sets its roadmap. Until buyers can check those three things, European procurement will keep producing sovereignty on paper.
To watch next week
Whether more European police forces drop Oxygen, and whether the Commission comments on its earlier project contacts; the first findings from Poland's investigation into Fakturownia, and any reports of invoice fraud using the stolen data; and how many Exchange Online tenants quietly re-enable EWS rather than migrate.
Facts link to their sources. Takes are the author's opinion.