According to the Treasury, IT specialists acted immediately upon detection of the intrusion by disconnecting the affected servers from the network to prevent further damage. The attack resulted in the encryption of files stored on the computers of certain employees, a technical indicator that suggests the deployment of ransomware or similar malicious software. Officials stressed that despite the impact on internal systems, no customer data has been compromised, and there is currently no evidence of data loss. The distinction between internal operational disruption and external data exposure is a key part of the official communication to stakeholders.
The response to the incident is being led by Treasury IT specialists working alongside experts from Hungary’s National Cyber Security Centre. Their primary objectives are to contain the attack fully and restore secure operations as quickly as possible. In accordance with applicable regulations, the Treasury has notified Hungary’s National Authority for Data Protection and Freedom of Information (NAIH). Reports indicate that the case is also being examined by the National Bureau of Investigation and the Special Service for National Security, highlighting the multi-agency approach to the investigation.
As a precautionary measure, certain electronic services used by the Agriculture and Rural Development Division remain available only on a limited basis. The Treasury has apologized for the temporary service disruptions and has asked users for patience while recovery efforts continue. The limited availability of these services is a direct consequence of the security protocols implemented to ensure that any restored systems are free from residual threats. The situation remains under active review as investigators work to determine the full scope of the intrusion and the specific methods used by the attackers.
Background reports indicate that Hungarian authorities have previously been aware of Russian cyber activities, including a recent coordinated attack on a Hungarian geothermal system. This context underscores the ongoing cybersecurity challenges faced by the nation’s critical infrastructure. While the current attack on the State Treasury is distinct, it aligns with a broader pattern of state-linked cyber threats targeting government and utility sectors in the region. The involvement of multiple national security bodies signals that the incident is viewed as more than a standard criminal cybercrime, potentially falling under the purview of national security concerns.
The investigation remains ongoing, with no confirmed timeline for the full restoration of all affected services. Authorities have not released further technical details regarding the specific vulnerabilities exploited or the exact duration of the attacker’s presence within the network. The focus remains on the safe recovery of internal operations and the completion of the forensic analysis. Until the investigation concludes, the limited service restrictions are expected to remain in place to prioritize the integrity and security of the restored systems.
