Hungarian Government Faces Security Crisis Due to Weak Passwords and Credential Reuse A Bellingcat investigation has exposed a major security lapse within Hungary’s government, revealing nearly 800 compromised email and password pairs tied to key ministries, including defense, foreign affairs, and finance. The findings suggest systemic negligence rather than targeted hacking, with officials relying on weak, reused passwords that eventually surfaced in breach dumps. Among the most concerning discoveries were 120 compromised records linked to defense personnel, some stemming from a 2023 NATO eLearning platform breach that exposed emails, passwords, and phone numbers. While much of the data dates back to 2021, new instances continue to emerge, with some recent infostealer logs indicating active device compromises as recently as last month. Password choices were particularly alarming. A colonel in "information security" used "FrankLampard" a reference to the former England footballer while a district director opted for "123456aA." Another senior official in Hungary’s NATO delegation used a password translating to "cute." Other examples included simple name-based passwords, easily guessable patterns, and credentials like "linkedinlinkedin" likely from the 2012 LinkedIn breach still in use. The root issue appears to be poor security hygiene: officials registered government emails on third-party services, then reused passwords across multiple platforms. Once those services were breached, the credentials spread through underground markets. The investigation also uncovered infostealer malware logs, suggesting some devices were actively compromised rather than just caught in old leaks. The incident underscores how basic security failures weak passwords, credential reuse, and unchecked third-party sign-ups can undermine even critical government functions. With no advanced hacking required, the breach highlights the persistent risks of human error in cybersecurity.