Hungarian government credentials exposed in breach databases
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Almost 800 Hungarian government email-password pairs leaked online, affecting 12 of 13 ministries via poor credential hygiene and prior compromises.
Bellingcat identified 795 unique email and password combinations from Hungarian government domains circulating in breach databases, affecting 12 of the country's 13 ministries. The breaches span multiple years, with the most recent data from 2026, and include credentials from senior officials in defence, foreign affairs, and national economy departments. Affected personnel include military officers responsible for information security, counter-terrorism coordinators, and staff handling classified diplomatic work. The analysis reveals systemic poor digital hygiene: government employees reused simple passwords ("Password", "1234567", personal names) across government email addresses and non-work services including dating, music, and food sites. Ministry of Defence credentials appeared in a 2023 NATO eLearning breach, and stealer logs indicate at least 97 machines across Hungarian government departments have been infected with credential-stealing malware, with infections detected as recently as one month before publication. This complements prior reporting of Russian state cyber activity against Hungary's foreign ministry network (2022) and classified systems. The breaches reflect fundamental absence of multi-factor authentication, credential monitoring, and incident response procedures rather than sophisticated state-level intrusion.
Mentioned in this report
Detection guidance
Command-Line Access to Browser Credential Stores or Windows Credential Manager
Detects shell or copy utilities reading browser credential databases (Login Data, logins.json, key4.db) or enumerating Windows Credential Manager with vaultcmd/cmdkey. These are common infostealer and hands-on credential harvesting behaviours. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command-Line Access to Browser Credential Stores or Windows Credential Manager
description: Detects shell or file-copy utilities touching browser credential databases
(Chromium Login Data, Firefox logins.json/key4.db) or enumerating Windows Credential
Manager via vaultcmd/cmdkey. Generalises on the stealer-style access pattern, not
on specific malware families. The report describes stealer-log infections but gives
no process-level detail, so this is a generic behavioural proxy for credential-stealing
malware.
tags:
- attack.credential-access
- attack.t1555
- attack.t1555.003
- attack.t1555.004
logsource:
category: process_creation
product: windows
detection:
selection_browser_store:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \robocopy.exe
- \xcopy.exe
- \esentutl.exe
CommandLine|contains:
- \Google\Chrome\User Data\Default\Login Data
- \Microsoft\Edge\User Data\Default\Login Data
- \BraveSoftware\Brave-Browser\User Data\Default\Login Data
- \Mozilla\Firefox\Profiles
- logins.json
- key4.db
selection_credman:
- Image|endswith: \vaultcmd.exe
CommandLine|contains:
- /list
- /listcreds
- Image|endswith: \cmdkey.exe
CommandLine|contains: /list
condition: 1 of selection_*
falsepositives:
- Browser profile backup or migration scripts run by IT staff
- Helpdesk troubleshooting that runs cmdkey /list to inspect stored credentials
level: medium
id: f0733cd0-0827-5d2b-bb41-2eb0b3099bc1
status: experimental
author: Vorant
references:
- https://www.bellingcat.com/news/2026/04/09/the-hungarian-government-passwords-exposed-online
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.bellingcat.com/news/2026/04/09/the-hungarian-government-passwords-exposed-online
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs