Cyber Incident Victim: eKRTA
Date:
Nov 2022
Location:
Hungary
Summary
A Hungarian educational technology provider managing sensitive student data was compromised by a cybercriminal group known as Sawarim. The breach exposed personal information belonging to hundreds of thousands of students aged 6 to 18, though the attackers claimed they would not release this specific data. Instead, the group leaked portions of the company's proprietary source code alongside internal communications, including email exchanges and chat logs involving state officials. The incident impacted a widely deployed school management platform storing extensive records across the country.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around November 11, 2022, Hungarian educational technology firm eKRÉTA experienced a cybersecurity breach perpetrated by a hacking group identified as Sawarim. eKRÉTA operates a widely deployed school management platform storing personal information for over 720,000 Hungarian students aged 6 to 18 years. The attackers gained unauthorized access to the company's systems, compromising sensitive student data and internal corporate materials. According to reports by Catalin Cimpanu's RiskyBiz News and local media outlets, the hackers initially disclosed their breach to Hungarian press while claiming they did not intend to release students' personal details. This assurance did not extend to eKRÉTA's proprietary information, as the group subsequently began leaking portions of the company's source code, internal chat logs, and email correspondence.
The leaked email communications included exchanges between eKRÉTA and Hungarian state officials, indicating potential exposure of government-related discussions. While the full scope of accessed student records remained unconfirmed, the incident raised concerns about the security of minors' personally identifiable information within educational systems. No technical details regarding breach methods, detection timelines, or containment measures were disclosed in available reports. Similarly, eKRÉTA's organizational response and remediation efforts were not described in the source material. The breach highlighted systemic vulnerabilities in an edtech platform serving Hungary's national education infrastructure, with compromised materials revealing internal operational aspects of both the company and its governmental interactions.