Discover how Signi simplifies the document workflow in companies like yours.
Last updated: 9 November 2026
This page answers the most common questions about the security incident we discovered in the Signi application on 6 November 2026. We will keep updating it as we learn anything significant. If you cannot find the answer to your question here, please write to us at gdpr@signi.com.
Important for customers: notifying the ÚOOÚ and the 72-hour deadline
Do I have to wait for your supporting documentation before notifying the ÚOOÚ?
No. The 72-hour deadline runs from the delivery of our incident notice, and you do not need to wait for our documentation before making the notification. Submit the notification without delay using the information you have from our notice. The GDPR allows information to be provided to the supervisory authority in phases (Article 33(4) GDPR): you can provide the exact number and list of affected contacts, as well as further details, at a later stage once we send them to you. The ÚOOÚ form allows you to submit both an initial notification and a subsequent supplement to it. We are preparing the documentation as quickly as possible, and you can request it at gdpr@signi.com.
On 6 November 2026 at 8:32, our monitoring detected suspicious activity in the application. An attacker with a registered user account had exploited a vulnerability that allowed them to view people’s contact details outside their own workspace. We fixed the vulnerability the same day at 10:00 and blocked the attacker’s account.
The data of contact persons stored in the application, meaning people to whom Signi users send documents for signature. The data of user accounts themselves, including login credentials and passwords, was not affected. The attacker also did not gain access to any documents or any other data.
For most contacts, the data was first name, last name, email address and phone number. For a limited number of contacts, it also included other details, where these had been stored with the contact: address, date of birth, company name, company ID, VAT ID, job title or custom user fields.
Our investigation has found no indication that the attacker accessed the content of documents stored in Signi, checklists, records from completed identity verifications, passwords or any other login credentials. No document was altered or tampered with. Signed documents therefore remain valid and unchanged.
If someone sent you a document for signature through Signi, your contact details may have been affected. The organization that sent you the document (the controller of your data) can confirm whether and which of your data was involved. You can also contact us directly at gdpr@signi.com.
The main risk is unsolicited marketing and fraudulent emails, text messages or phone calls (phishing and vishing). If your contact record also included an address or date of birth, a fraudulent message may appear more personal and convincing. We currently have no information that the data has been published or misused.
No. Passwords were not affected, so there is no need to change yours because of this incident.
If you have no contacts stored in your workspace, or you use them solely for personal purposes, you have no obligations arising from this incident. If you store contacts in the application to whom you send documents for signature as part of your business or professional activity, you are the controller of their data under the GDPR, and Signi acts as the processor.
On request, we will send you the number and a full list of the affected contacts in your workspace, including the categories of data involved. We send the list securely as a password-protected file and share the password through a separate channel. Please write to us at gdpr@signi.com.
As the controller, you are responsible for assessing whether you must report the incident. The deadline is 72 hours from the moment you became aware of it, which in practice means from receiving our notification. In the Czech Republic, you can submit the report using the form at uoou.gov.cz or through the data box qkbaa2n. In Slovakia, the report goes to the Office for Personal Data Protection of the Slovak Republic. In other countries, report it to the competent supervisory authority. However, you do not need to wait for our supporting documentation before making the notification; see the question at the top of this page.
A report is not required only if the breach is unlikely to put the affected individuals at risk. Given the risk of targeted phishing, we recommend submitting one. You will find detailed instructions in our guide for customers.
You must inform the affected individuals if the breach poses a high risk to them. Even if it does not, we recommend informing your contacts. If you decide not to, record your reasons. If you have a large number of contacts, you can at least refer them to this page.
Yes. On request, we will provide a structured document with a timeline, the scope of the incident and the measures taken. Please also keep our notification and a record of the steps you took in response. The authority may ask to see them.
Yes. By notifying you of the incident, we are meeting the processor’s notification obligation under Article 33(2) of the GDPR, Article 11.15 of the Terms and Conditions for the Provision of Signi Services, and Article 5.6 of the Data Processing Agreement.
The cause was a vulnerability in an authorization check, which allowed a registered user to view the data of contact persons outside their own workspace.
Yes. We fixed the vulnerability on 6 November 2026 at 10:00 and verified that it can no longer be exploited. The attacker’s account is blocked. We are also analyzing traffic and reviewing the security of the application to rule out related risks and put additional preventive measures in place.
Our application monitoring detected suspicious activity. We fixed the vulnerability within 90 minutes of discovering it.
Yes. The exploited vulnerability has been fixed and verified, signed documents were not affected, and login credentials remain secure.
Because the investigation is ongoing, we are not commenting on the attacker’s identity. We have preserved records of their activity and are filing a criminal complaint with the Czech Police.
We currently have no information that the data has been published or misused. We are actively monitoring whether it appears online, and we are checking that our sending domains are protected against spoofing.
We are reporting the incident to the Office for Personal Data Protection and have also voluntarily notified the National Cyber and Information Security Agency (NÚKIB). We are retaining the incident logs for law enforcement and the supervisory authority.
For any questions about the incident, write to us at gdpr@signi.com. Media representatives can contact michal.marek@bisonrose.cz.
In light of a recent security incident, we advise you to exercise heightened caution when communicating via email or telephone. The leaked data could be exploited for targeted fraudulent messages or phone calls that may appear more credible, as the attacker might already possess your name, job title, phone number, or other personal details.
We therefore recommend paying extra attention to the following:
Important: In connection with this security incident, Signi will never ask you—via email or telephone—to disclose any information, passwords, access credentials, or other sensitive data, nor will we request that you change such details via a link provided in an unsolicited message. If you are unsure whether a message or phone call is genuinely from Signi, do not respond; instead, verify its authenticity directly with your usual contact at Signi or via email at help@signi.com.
At this time, we have no information suggesting that the obtained data has been disclosed or misused. We continue to monitor the situation and will inform our customers should any further significant findings emerge.
Digitalization of signing and company processes is our topic. We write about how to move from paper to digital documents. And we show that it's not such a rocket science.
