Loading story…
Hundreds of Hungarian government credentials were found circulating in breach databases, exposing 795 unique email-password pairs tied to 12 of Hungary’s 13 ministries and personnel in sensitive defence, foreign affairs, interior, and economic roles. Bellingcat reported that the pattern pointed less to a single sophisticated state intrusion than to chronic security failures, including weak and reused passwords, use of official email accounts on non-work services, and signs of credential-stealing malware on 97 machines. The findings added to earlier warnings about Hungary’s cyber posture, including prior reporting that Russian intelligence had compromised the foreign ministry and an official letter describing thousands of workstations and hundreds of servers as unreliable.
In Germany, Julia Klöckner was reported by Der Spiegel to have been caught up in the recent Signal phishing campaign targeting political figures in Berlin’s government district. The incidents together underscored how senior officials remain vulnerable to basic account compromise techniques, from password reuse and infostealer infections to phishing against secure messaging platforms, increasing the risk of unauthorized access to sensitive government communications and systems.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Bellingcat found 795 unique Hungarian government email and password combinations circulating in breach databases, affecting 12 of Hungary's 13 ministries and personnel in sensitive roles across defence, foreign affairs, interior, and economic institutions. The exposed credentials included weak and reused passwords and government email use on non-work services.
Bellingcat reported evidence of credential-stealing malware infections on 97 machines tied to Hungarian government personnel. The finding supported the conclusion that exposed credentials were likely driven by poor cyber hygiene rather than a single sophisticated intrusion.
In a later letter, Hungary's National Security Service linked the attacks on government systems to Russia and described more than 4,000 workstations and 930 servers as "unreliable." This indicated a broader compromise or loss of trust in government IT infrastructure.
Earlier reporting cited by Bellingcat said Russian intelligence had compromised Hungary's foreign ministry, marking a major prior cybersecurity incident affecting the government. The exact date is not specified in the reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An investigation by Bellingcat found nearly 800 Hungarian government email and password pairs circulating in breach dumps, affecting almost every major ministry, including **defense**, **foreign affairs**, and **finance**. The exposed credentials were largely tied to weak password practices, password reuse on third-party services, and data from earlier breaches rather than a single sophisticated intrusion. Reported examples of compromised passwords included trivial choices such as `FrankLampard`, `123456aA`, and `cute`. About 120 of the exposed records were linked to defense personnel, including credentials associated with a 2023 breach of NATO's eLearning platform. Bellingcat also identified infostealer logs from dozens of machines, with some evidence as recent as last month, indicating that at least some systems may have been actively compromised more recently. The leaked credential data reportedly continued to surface through 2026, highlighting persistent security hygiene failures in sensitive Hungarian government functions.
Jun 29, 2026
CERT-EU has formally warned that state-backed actors are conducting tailored spearphishing and social-engineering campaigns against senior European Union officials on WhatsApp and Signal. Attackers used impersonation lures, including a fraudulent Signal support chatbot, to steal authentication codes, take over messaging accounts, and gain access to incoming communications and group chats. Dutch intelligence attributed related activity to Russia, while German authorities warned that political, military, diplomatic, and investigative-journalist targets were at risk. An internal CERT-EU presentation delivered to national-government officials identified messaging-account takeover as a leading threat and reported eight significant incidents affecting EU institutions since the start of 2026. The warning also highlighted fragmented security tooling across EU bodies and the absence of a shared platform for exchanging sensitive or classified documents, leaving high-value communications exposed to targeted compromise.
Aug 28, 2026
Poland said a cyberattack compromised the private email accounts of senior officials, ministers, members of parliament, and journalists, with stolen messages later leaked on Telegram. Authorities said the campaign affected more than 30 people, included the mailbox and social media compromise of Prime Minister’s Office chief Michał Dworczyk and his wife, and was assessed by Poland’s Internal Security Agency, Military Counterintelligence Service, and allied intelligence services as having been conducted from infrastructure in the Russian Federation. Polish officials described the operation as a broad attempt to destabilize the country, while investigators preserved evidence and notified affected individuals with guidance to secure their accounts. Separate reporting from **CERT Polska** and **SKW** tied ongoing Russian espionage activity against NATO and EU diplomatic targets to infrastructure, techniques, and tooling overlapping with **NOBELIUM/APT29**, including spear-phishing, malicious links, **HTML Smuggling**, deceptive shortcut files, hidden DLL execution, and DLL sideloading, reinforcing the assessment that the breach fit a wider Russian intelligence collection campaign.
Aug 15, 2026