Loading story…
An investigation by Bellingcat found nearly 800 Hungarian government email and password pairs circulating in breach dumps, affecting almost every major ministry, including defense, foreign affairs, and finance. The exposed credentials were largely tied to weak password practices, password reuse on third-party services, and data from earlier breaches rather than a single sophisticated intrusion. Reported examples of compromised passwords included trivial choices such as FrankLampard, 123456aA, and cute.
About 120 of the exposed records were linked to defense personnel, including credentials associated with a 2023 breach of NATO's eLearning platform. Bellingcat also identified infostealer logs from dozens of machines, with some evidence as recent as last month, indicating that at least some systems may have been actively compromised more recently. The leaked credential data reportedly continued to surface through 2026, highlighting persistent security hygiene failures in sensitive Hungarian government functions.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Bellingcat found nearly 800 Hungarian government email and password pairs circulating in breach dumps, affecting ministries including defense, foreign affairs, and finance. The investigation highlighted weak passwords, password reuse, and continued credential exposure into 2026.
Bellingcat identified infostealer logs from dozens of machines associated with Hungarian government users, indicating some systems may have been actively compromised. Some of these logs were described as appearing as recently as the month before the April 2026 reporting.
A 2023 breach of NATO's eLearning platform contributed to the exposure of some Hungarian government credentials, including records tied to defense personnel. Reporting later linked part of roughly 120 compromised defense-related records to this incident.
Leaked credential data involving Hungarian government email accounts surged in 2021, reflecting widespread password reuse on third-party services rather than a single centralized intrusion. The exposed records ultimately affected nearly 800 email-password pairs across major ministries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hundreds of Hungarian government credentials were found circulating in breach databases, exposing **795 unique email-password pairs** tied to **12 of Hungary’s 13 ministries** and personnel in sensitive defence, foreign affairs, interior, and economic roles. Bellingcat reported that the pattern pointed less to a single sophisticated state intrusion than to chronic security failures, including weak and reused passwords, use of official email accounts on non-work services, and signs of credential-stealing malware on **97 machines**. The findings added to earlier warnings about Hungary’s cyber posture, including prior reporting that Russian intelligence had compromised the foreign ministry and an official letter describing thousands of workstations and hundreds of servers as unreliable. In Germany, **Julia Klöckner** was reported by *Der Spiegel* to have been caught up in the recent **Signal phishing campaign** targeting political figures in Berlin’s government district. The incidents together underscored how senior officials remain vulnerable to basic account compromise techniques, from password reuse and infostealer infections to phishing against secure messaging platforms, increasing the risk of unauthorized access to sensitive government communications and systems.
Jun 29, 2026
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
A publicly accessible database containing **~149.4 million unique usernames and passwords** (about **96GB** of data) was discovered online by security researcher **Jeremiah Fowler**. The trove included not just credential pairs but also associated site links, indicating it was designed to enable direct account access across many services; major concentrations included **Gmail (48M)**, **Facebook (17M)**, **Instagram (6.5M)**, **Yahoo (4M)**, **Netflix (3.4M)**, **Outlook (1.5M)**, **iCloud (900K)**, and **Binance (420K)**. The database was reportedly **not encrypted and not password-protected**, and it also contained credentials tied to **.gov domains** from multiple countries, raising risks of follow-on activity such as spearphishing, impersonation, and potential access attempts against government networks. Fowler reported the exposure to the hosting provider, and the database was subsequently **removed for terms-of-service violations**; Fowler said he could not determine who owned or operated the dataset. Reporting indicates the database likely aggregated logs from **infostealer malware**, which commonly uses techniques like **keylogging** to capture credentials from infected devices; Fowler noted the dataset continued to **grow over roughly a month** while he worked to reach the host. The hosting arrangement was described as a global provider using regional affiliates, with the exposed instance attributed to an affiliate in **Canada**, and the provider was not publicly named.
Jun 29, 2026