Hungary confirmed INC Ransom hack of its defence procurement agency

On November 14, 2024, the Hungarian government confirmed that the Defence Procurement Agency, known by its Hungarian initials VBU, had been breached. The agency handles the country's defence and security acquisitions. Gergely Gulyas, chief of staff to Prime Minister Viktor Orban, told a briefing that a hostile foreign, non-state hacker group was responsible.

The intrusion was claimed by INC Ransom, an extortion operation that emerged in 2023 and has concentrated on healthcare, education and government targets. The group said it had downloaded and encrypted the agency's files, posted sample screenshots on its dark web portal and demanded $5 million.

Material said to have been taken included military procurement plans and data, documents relating to the Hungarian army's air and land capabilities, and financial records. Daily News Hungary reported that a Defence Logistics Support Command document indicating a procurement freeze for the following year was among the leaked files, and that some material had spread beyond dark web sites onto the open internet. Reporting described the stolen files as fairly recent, with some dating to October 2024, and leaks beginning around November 6.

The Ministry of Defence confirmed the attack but declined to detail what had been lost, stating that the VBU does not hold the most sensitive military data and that no information on military structure had been exposed. Officials said defence spending was continuing without interruption and that an investigation was underway.