# Hungarian government credentials exposed in breach databases

Published: 2026-04-09 · Severity: routine · Sectors: government-national, defense
Canonical: https://vorant.io/reports/5ec88274-a6f3-5562-81f0-ac05f67bd923/hungarian-government-credentials-exposed-in-breach-databases

> Almost 800 Hungarian government email-password pairs leaked online, affecting 12 of 13 ministries via poor credential hygiene and prior compromises.

Bellingcat identified 795 unique email and password combinations from Hungarian government domains circulating in breach databases, affecting 12 of the country's 13 ministries. The breaches span multiple years, with the most recent data from 2026, and include credentials from senior officials in defence, foreign affairs, and national economy departments. Affected personnel include military officers responsible for information security, counter-terrorism coordinators, and staff handling classified diplomatic work. The analysis reveals systemic poor digital hygiene: government employees reused simple passwords ("Password", "1234567", personal names) across government email addresses and non-work services including dating, music, and food sites. Ministry of Defence credentials appeared in a 2023 NATO eLearning breach, and stealer logs indicate at least 97 machines across Hungarian government departments have been infected with credential-stealing malware, with infections detected as recently as one month before publication. This complements prior reporting of Russian state cyber activity against Hungary's foreign ministry network (2022) and classified systems. The breaches reflect fundamental absence of multi-factor authentication, credential monitoring, and incident response procedures rather than sophisticated state-level intrusion.

## Mentioned in this report

- Malware: Stealer

## Detection guidance (public sample)

### Command-Line Access to Browser Credential Stores or Windows Credential Manager

ATT&CK: T1555

Detects shell or copy utilities reading browser credential databases (Login Data, logins.json, key4.db) or enumerating Windows Credential Manager with vaultcmd/cmdkey. These are common infostealer and hands-on credential harvesting behaviours. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command-Line Access to Browser Credential Stores or Windows Credential Manager
description: Detects shell or file-copy utilities touching browser credential databases
  (Chromium Login Data, Firefox logins.json/key4.db) or enumerating Windows Credential
  Manager via vaultcmd/cmdkey. Generalises on the stealer-style access pattern, not
  on specific malware families. The report describes stealer-log infections but gives
  no process-level detail, so this is a generic behavioural proxy for credential-stealing
  malware.
tags:
- attack.credential-access
- attack.t1555
- attack.t1555.003
- attack.t1555.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser_store:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \robocopy.exe
    - \xcopy.exe
    - \esentutl.exe
    CommandLine|contains:
    - \Google\Chrome\User Data\Default\Login Data
    - \Microsoft\Edge\User Data\Default\Login Data
    - \BraveSoftware\Brave-Browser\User Data\Default\Login Data
    - \Mozilla\Firefox\Profiles
    - logins.json
    - key4.db
  selection_credman:
  - Image|endswith: \vaultcmd.exe
    CommandLine|contains:
    - /list
    - /listcreds
  - Image|endswith: \cmdkey.exe
    CommandLine|contains: /list
  condition: 1 of selection_*
falsepositives:
- Browser profile backup or migration scripts run by IT staff
- Helpdesk troubleshooting that runs cmdkey /list to inspect stored credentials
level: medium
id: f0733cd0-0827-5d2b-bb41-2eb0b3099bc1
status: experimental
author: Vorant
references:
- https://www.bellingcat.com/news/2026/04/09/the-hungarian-government-passwords-exposed-online
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.bellingcat.com/news/2026/04/09/the-hungarian-government-passwords-exposed-online

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5ec88274-a6f3-5562-81f0-ac05f67bd923/hungarian-government-credentials-exposed-in-breach-databases.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup