Körmend Város Önkormányzata (Municipality of Körmend)

We noticed a significant data leak surfacing on a well-known underground forum on August 26, 2018. This incident involved the Municipality of Körmend, a Hungarian local government entity responsible for a wide array of public services and community information. What struck us was the direct exposure of user credentials, specifically email addresses paired with MD5 password hashes, impacting a substantial portion of their user base. The nature of the leaked data suggests a direct compromise of a user database, rather than a more sophisticated supply-chain or phishing-driven attack, though the implications remain severe.

The breach breakdown reveals that 12,274 records were exposed, primarily consisting of email addresses and their corresponding MD5 password hashes. This data likely originated from a direct database compromise, potentially an SQL injection or similar vulnerability that allowed unauthorized access to user authentication tables. The use of MD5, a demonstrably weak hashing algorithm, is a critical point of concern, as these hashes are highly susceptible to brute-force and rainbow table attacks, meaning the plaintext passwords could be readily recovered by malicious actors. The threat theme here is clear: credential stuffing and account takeover are imminent risks for any user who has reused their password across other services, amplifying the potential impact beyond the immediate compromise of the municipality's systems.

While this specific incident did not generate widespread mainstream news coverage at the time of its discovery, it aligns with a broader trend of local government entities becoming targets for cyberattacks due to perceived lower security postures. Research into similar municipal data breaches in Eastern Europe during that period indicates a consistent pattern of vulnerability to credential exposure. The presence of this dataset on a prominent hacking forum also suggests it was likely aggregated and intended for use in large-scale credential stuffing operations targeting other platforms where these compromised credentials might be reused.