A hálózat csapdájában

A kiberbiztonságról, mikro- és kisvállalkozásoknak

My company practically lives on Facebook. Is that a problem?

No. But there are a few things worth knowing – without the technical jargon

If you run a Hungarian business with 1–50 employees, and your company’s Facebook page effectively serves as your website, advertising platform, customer service channel and order-taking system all in one – then you’ve come to the right place. And no, this isn’t some kind of beginner’s mistake. It was a perfectly sensible decision: that’s where your customers are, it’s free, and it works.

This article isn’t about telling you to abandon Facebook. It’s about the few things that could actually wipe out in a single weekend what you’ve built up over ten years – and the few steps you can take to largely prevent that from happening. You don’t need to be an IT expert for any of these steps, and none of them cost a penny.

Let’s start with a frank statement: most of the scare stories you hear about cyber security really are an exaggeration. Your company isn’t going to be attacked by a foreign intelligence service. However, the sort of attack that actually affects small Hungarian businesses is mundane, automated and widespread – and that’s precisely why it affects so many.

Why my company, of all places?

This is the most common question, and it’s entirely justified. The answer: you weren’t specifically targeted. Nobody was “targeted”.

Modern online fraud is mass-produced. The attacker doesn’t know who you are, probably doesn’t even know exactly how big your company is, and doesn’t care. They send out ten thousand messages and are satisfied if fifty people reply.

Just to illustrate how far from a theoretical problem this is: according to a police report, in 2025, 22,722 cases of online fraud were recorded in police investigations as part of the Matrix Project, and the majority of these offences continue to be scams based on psychological manipulation. According to the same report, the police prevented 3.9 billion forints from falling into the hands of criminals.

These figures relate to all online fraud, not just on Facebook, and not just targeting companies – but they clearly illustrate the scale of the problem.

Five things worth understanding

1. Your personal profile is the main gateway. Not the page.

This is the most important sentence in the whole article, and many people are unaware of it.

A company’s Facebook page does not have its own password. The page is managed by personal profiles that have been granted admin rights. In other words: if someone gains access to your private profile – where your family photos and secondary school classmates are – they also gain access to the company’s page.

The reverse is also true. If there is only one admin and something happens to their personal account, the page may become inaccessible.

2. “Forward the code” – and its more modern variants

The classic version: an acquaintance messages you on Messenger, saying they’ve received an SMS code for some reason and asking you to forward it to them. According to information from the National Cyber Security Institute (NBSZ), if someone passes on these codes, attackers – having obtained the email address – can take control of the user’s account by resetting the password and changing the email address, thereby locking out the account’s rightful owner; after which they can search for further victims amongst the contacts of the compromised account.

The NKI’s advice on this is simple and sound: treat Facebook messages with due suspicion, and if you know the sender, verify the message via another channel – such as by telephone.

The variant targeting business leaders is far more sophisticated. In 2025, researchers at Bitdefender described a phishing campaign that specifically targeted small business owners with emails from Meta that appeared official, citing alleged breaches of brand or advertising policies, with the aim of ultimately taking over their Facebook Business accounts. A particularly insidious aspect of the campaign is that it does not ask for the password straight away – which makes many people feel safe.

If you’re familiar with that shock you get when an email arrives saying “your page will be deleted within 24 hours” – that’s exactly the aim. The sense of urgency is the attack itself.

3. Neither your password nor two-factor authentication will protect you if malware is running on your computer

This is the part that very few people are aware of, yet it causes the most costly damage.

When you log in to Facebook, your browser stores a small file (a cookie) that says: ‘this computer is already logged in’. If malware steals this cookie, the attacker needs neither your password nor the two-factor authentication code – they simply log in as you.

Researchers at Palo Alto Networks’ Unit 42 analysed precisely this type of malware family: NodeStealer enabled attackers to steal browser cookies and thereby take over accounts, specifically targeting business accounts. This is part of a wider trend in which attackers are targeting Facebook business accounts – including for the purpose of ad fraud – a trend that began around July 2022 with the discovery of a data-stealing malware called Ducktail.

This activity remains ongoing: in September 2025, The Hacker News reported that fake, browser extensions targeting Meta advertisers had gained full access to every page visited, with the ultimate aim of selling valuable Facebook Business and advertising accounts on underground forums or using them for further malicious advertising campaigns.

In short: ‘useful little extensions’ installed in the browser and downloaded programmes of dubious origin pose a serious risk – on the very computer used to manage the advertising account.

The NKI has also reported on the scale of this phenomenon: according to estimates regarding a phishing campaign that has become known as ‘AccountDumpling’, around 30,000 Facebook Business accounts fell victim to it.

4. Your advertising account is real money – your money

If your advertising account is taken over, they won’t just be posting. They’ll be running adverts – using your credit card. The damage isn’t measured in lost ‘likes’, but in forints, and you won’t always notice it straight away.

5. Legally, the page isn’t yours

This is unpleasant, but important. According to Meta’s Terms of Service, if Meta, at its sole discretion, determines that a user has clearly, seriously or repeatedly breached the terms or policies, it may suspend or permanently disable access to Meta’s services, and may permanently disable or delete the account.

This is no conspiracy – every platform works this way. But the implication is significant: the ‘business premises’ in which your company operates are rented, and the landlord can terminate the tenancy unilaterally. This can happen by mistake, following a decision by an automated system.

That is why there is a very simple, non-IT piece of advice towards the end of the article: make sure you have a backup of what is truly yours.

And what about the legislation? I have a reassuring answer to this

Many people have heard of NIS2 and the new cybersecurity law, and are rightly concerned that this will be yet another burden.

It is unlikely to apply to most Hungarian companies with 10–250 employees. The scope of Act LXIX of 2024 on cybersecurity in Hungary does not simply extend to all SMEs: according to the Act, for an organisation to be affected, it must belong to one of the sectors listed in the annexes, and even within this scope – as set out in Annex 2 – it applies only to those organisations which are classified as medium-sized enterprises under the SME Act or which exceed the thresholds prescribed for medium-sized enterprises. A hairdressing salon, a joiner’s workshop or an online shop would not typically feature on this list.

However, there are two things that apply to you regardless of your size:

a) The GDPR. This applies even if you only run a Facebook page. In fact, the Court of Justice of the European Union ruled in Case C-210/16 (Wirtschaftsakademie) that the administrator of a Facebook fan page is jointly liable with Facebook for the processing of the data of visitors to the page. Customer data received via Messenger – names, telephone numbers, addresses, and sometimes health or financial information – constitutes personal data. If this data is stolen, it constitutes a data breach.

b) Your partners’ expectations. If you are a supplier to a larger company subject to NIS2, there is a good chance that you will also be asked to take certain steps – not by the regulator, but by your customer.

What can be done in a Saturday morning

This list is deliberately short. You don’t need to do everything at once. The order is important: the first three provide the bulk of the protection.

1. Two-factor authentication – using an authentication app, not via text message. Google Authenticator or a similar app is free and takes ten minutes to set up. Why not text messages? Because an SMS code can be tricked out of you (see above), whereas the code in the app is harder to obtain.

2. Have at least two administrators – two different people, using two separate devices. If you’re the only administrator and something happens to you – a holiday, a hospital stay, a stolen phone, or a blocked account – the company’s page will be inaccessible. Having a trusted colleague or family member as a second administrator is like having free life insurance.

3. Check who currently has access to the page. You can see this in Meta Business Suite. There’s a good chance you’ll find a marketing intern from 2019 and two agencies you no longer work with. Revoke their access rights.

4. Check the logged-in devices. If there’s a phone number or town on the list that you don’t recognise, log it out. NKI warns that attackers sometimes don’t block the owner immediately, but instead use the profile alongside the owner’s for a while, waiting for the right opportunity – which is why it’s worth checking the logged-in devices from time to time.

5. Use a separate bank card with a low spending limit for your advertising account. This isn’t an IT issue, but a banking one. It takes five minutes, and you’ll minimise the damage.

6. Ensure that the computer used to manage the company website has no pirated software or unknown browser extensions. Check your browser extensions and delete any you don’t recognise.

7. Back up what really belongs to you. Customers’ phone numbers, email addresses and order history – these don’t belong to Facebook, but if the page disappears, you still won’t be able to access them. Even a simple spreadsheet is better than nothing. If possible, a domain of your own and a one-page website are addresses that nobody can take away from you.

8. Write down on a piece of paper who to contact if there’s a problem. (See the next section.)

If it’s already happened – what to do in the first hour

Don’t be embarrassed, and don’t wait. According to the MNB, the sooner you act, the greater your chances of minimising the damage and preventing further losses – and this is true even if you’re not certain that fraud has taken place, but only that it’s a possibility.

  1. Change your password on a different, clean device – not the one that may have been compromised.
  2. Log out of all devices.
  3. Check the email address and phone number associated with your account – attackers often change these first.
  4. If you have suffered financial loss: contact your bank immediately, then the police. According to the KiberPajzs guide, report the incident to the police as quickly as possible – dial 112 – and reporting it to your bank promptly will significantly increase your chances of recovering the money.
  5. Report it to the NKI as well (nki.gov.hu). It’s free, and it helps others too.
  6. Tell your customers not to click on anything sent in your name.

The NKI has published a separate, free guide in Hungarian specifically for this situation – you’ll find the link below.

One thing you must not do: do not search on Google for terms such as ‘Meta customer service telephone number’. A significant proportion of the ‘support’ telephone numbers and paid ‘account recovery’ services that appear in such searches are themselves scams – preying precisely on business owners like you who find themselves in a desperate situation. Use only the official help and appeal interfaces within Facebook.

What we do not know for certain – and it is fairer to say so

I have not found any reliable Hungarian statistics on how many domestic small businesses lose their Facebook pages each year. No one collects such data on a regular basis, and if anyone gives you a specific figure, ask them where they got it from.

The often-cited figure that ‘57 per cent of small businesses would go under following an attack’ should also be treated with caution. This figure comes from ENISA’s 2021 SME report, in which 57 per cent of the SMEs surveyed said they would probably go out of business – but the survey involved just over 250 European SMEs between July and September 2020, and ENISA itself provides the corresponding figure differently (80 per cent, 85 per cent and 90 per cent respectively). It is useful as an indication of the order of magnitude, but not as precise data.

This does not detract from the main point. The main point is not a matter of statistics: if a large proportion of your company’s revenue comes via a platform that you do not own, then it is worth having two administrators, an authentication app and a backed-up customer list. That’s all.

Finally

If you take just one thing away from this article, let it be this: set up two-factor authentication with an authentication app, and add a second admin. It takes twenty minutes, it’s free, and it addresses a significant proportion of the risks mentioned above.

The rest can wait until next weekend.

Sources

Hungarian regulatory and official sources

Legislation and court rulings

  1. Act LXIX of [year] on Hungary’s cyber security (current text): https://net.jogtar.hu/jogszabaly?docid=a2400069.tv
  2. Act LXIX of – National Legislation Database: https://njt.jog.gov.hu/jogszabaly/2024-69-K0-00

Platform terms and conditions

Cybersecurity research and technical reports

Other support for Hungarian SMEs

Vélemény, hozzászólás?