A hálózat csapdájában

A kiberbiztonságról, mikro- és kisvállalkozásoknak

The 7 most likely threats to the IT security of Hungarian small businesses

If you run a Hungarian company with 1–50 employees and have so far thought that cyber security is a problem for banks, large multinationals and government bodies, then it is perfectly understandable that you would think that.

Newspapers, too, mainly report on major cyber-attacks. And the marketing materials of cyber-security firms are often couched in language that sounds as though someone sitting in a server room is trying to scare us.

This article isn’t intended to scare you. It simply sets out what, in practice, could actually affect a small or medium-sized Hungarian business – and there’s some good news at the end: the vast majority of the most common incidents can be stopped with a few simple, inexpensive steps. You don’t need to be an IT specialist to understand what’s going on.

Firstly: the attackers aren’t after you

This is the most important misconception. Many people imagine a cyberattack as someone selecting a company, studying it for weeks, and then launching a targeted strike. This is indeed how it works with large companies.

For smaller companies, however, the attack is typically not personalised. It is automated. Fraudsters send out hundreds of thousands of emails, try leaked passwords en masse, and constantly scan the internet for open remote access points. They don’t know who you are. You’re simply there on the network.

This leads to the second misconception: ‘there’s nothing to steal from us’. You may not have any trade secrets that a competitor would pay for. But you have a bank account from which money can be transferred. You have customer data. You have invoices, contracts and quotations. And most importantly: you have a functioning business that stands to lose a great deal if it cannot operate for three days.

The attacker isn’t interested in how important you are. They’re interested in how easy you are to target.

The seven most likely threats – in order

1. Phishing – the email that looks almost genuine

This is by far the most common point of entry. You receive an email that looks as though it’s from the tax authority, your bank, Microsoft, a courier service or even your own accountant. It contains a link that takes you to a login page that’s almost identical. You enter your password – and with that, you’ve handed it over.

Nowadays, it’s rarely possible to spot the scam by the old tell-tale sign of broken Hungarian: thanks to artificial intelligence, even scam emails written in Hungarian are now flawless. The tell-tale sign is more likely to be the urgency: “Take action within 24 hours”, “we have blocked your account”, “check your login details”.

2. Invoice fraud and ‘boss’ references (BEC)

This is the type of fraud that takes the most real money from Hungarian SMEs, and is technically the least conspicuous.

There are two typical variants:

  • Altered bank account number. The bank account number on an invoice from a supplier has been changed. The email appears genuine because it either comes from a genuinely hacked email account or from a domain that differs by just one character (e.g. kft-pariner.hu instead of kft-partner.hu). The transfer goes through, and the money disappears.
  • Urgent request from the manager. The finance manager or office manager receives an email, ostensibly from the company director: “I’m in a meeting right now, so please don’t call me, but could you transfer this amount today?” The emphasis is on the urgency and on preventing any follow-up questions.

3. Ransomware – when nothing opens one morning

This is what most people fear, and rightly so. Ransomware encrypts the company’s files – accounts, customer records, contracts – and demands a ransom for their restoration. More sophisticated variants first make copies of the data and also threaten to make it public.

There are two common points of entry for smaller companies: an opened email attachment, or unprotected remote access (RDP), which many set up whilst working from home and have left open ever since.

According to a 2023 Sophos survey of Hungarian companies, in nearly a third of firms affected by ransomware, the attackers gained access via a phishing message – meaning that points 1 and 3 are, in fact, two sides of the same story.

4. Stolen and reused passwords

If you use the same password for your work email as you do for an online shop – a password that was leaked five years ago – then your password has probably been circulating in a database for a long time. Attackers try these out en masse. It doesn’t require any specialist knowledge.

The most common consequence isn’t even spectacular damage, but rather that someone is quietly reading your company’s emails – and waiting for the next large invoice so they can use the trick described in point 2.

5. The company’s social media and advertising accounts

For many small businesses, their most valuable digital asset is their Facebook page or Google account, containing their advertising credit details. Hijacking these has become an industry in its own right: fraudsters run adverts in the page’s name, or simply spend the advertising budget. Recovering these accounts from the major platforms is a slow and frustrating process.

6. Trouble arising through partners

A small business is rarely on its own: there’s the accountant, the IT contractor, the web developer and the invoicing software provider. If an incident occurs with them, it could affect you too – either because your data is leaked, or because a fraudulent email is sent from a partner’s account that has actually been hacked. This is no reason to be distrustful, but it is a reason to have an agreed-upon method for checking up on one another regarding financial matters.

7. Everyday mishaps that aren’t actually attacks

Finally, it’s worth pointing out that a significant proportion of corporate data losses are not the result of criminal activity. A lost or stolen laptop. A misplaced mobile phone containing company emails. A folder accidentally deleted. A departing employee whose access has not been revoked. A faulty hard drive with no backup.

The same defences apply against these as against attacks – which is why it’s worth addressing them.

One point worth treating with caution:

there is increasing talk of voices cloned using artificial intelligence and deepfake video calls. There are indeed examples of these, but I have no reliable data on how widespread they are in the SME sector in Hungary. For the time being, it is better to focus on points 1–3.

And if it does happen? What does it actually cost?

Not just in direct financial terms. Experience shows that the biggest costs are usually:

  • Downtime: how many days you are unable to invoice, manufacture or deliver;
  • The working hours spent on recovery, often involving an external expert;
  • Customer trust, if their data is also affected;
  • Data protection obligations: if personal data is compromised, under the GDPR you may generally be required to report this to the NAIH within 72 hours. Exactly when this obligation arises depends on the specific circumstances – in such cases, it is advisable to consult a data protection expert.

The good news: the basics really are worth a lot

Here comes the bit that makes it worth reading this far. The vast majority of the scenarios listed above do not depend on sophisticated technology, but on a missing basic step. These steps are not expensive and do not require IT expertise:

  1. Two-factor authentication (MFA) for everything that matters. Work email, banking, accounting software, social media. This single step alone renders a huge number of attacks ineffective, because a stolen password on its own is no longer enough.
  2. Backups – which have actually been tested. A backup is only worth anything if the attacker cannot access it, and if someone has already tested the restoration process. A backup that has never been tested is just wishful thinking.
  3. Updates enabled. Operating system, browser, phone, and especially anything accessible from the outside.
  4. Password manager. This way, a different password is used for every site, and no one has to remember them all.
  5. One rule about money: “I’ll ring you back”. If a bank account number changes or an urgent transfer is requested, you must always double-check this using a previously known telephone number – never the number provided in an email. This single sentence in the company’s internal policy reduces the cost of the most expensive damage by an order of magnitude.
  6. A half-hour discussion with the team. Not a training course. It’s enough for everyone to know that if they’ve clicked on something, they’ll be fine as long as they speak up straight away. The incidents that can be rectified most quickly are those that aren’t kept secret.

Where can you turn in Hungary?

  • National Cyber Security Institute (NKI, nki.gov.hu) – the national cyber security authority; incident reporting and information sheets, with up-to-date warnings.
  • kiberpajzs.hu – the website of the joint programme launched in 2022 by the MNB, the Hungarian Banking Association, the NMHH, the NBSZ-NKI and the ORFK, featuring easy-to-understand descriptions of the most common scams. It is primarily aimed at the general public, but the methods described are the same as those encountered by businesses.
  • Your bank – the first place to call if you suspect financial fraud; the sooner you call, the greater the chance of stopping the transaction.
  • The police – to report a crime.

A word on regulation –briefly

You may have heard of the NIS2 Directive, which has been transposed into Hungarian law by Act LXIX of 2024 on cybersecurity in Hungary; in the private sector, supervision is carried out by the Supervisory Authority for Regulated Activities (SZTFH). This obligation does not apply to every company: it essentially applies to organisations operating in the sectors listed in the Act and meeting a specified size threshold.

Whether your company is affected depends on its sector and size, and no single blog post can decide this for you. If there is even the slightest suspicion that you might be affected, it is worth seeking legal or expert advice – as the penalties are severe. However, it is important to note: this article is not about compliance. The six basic steps outlined above are still worth taking, even if, strictly speaking, you are under no legal obligation to do so.

In conclusion

Cybersecurity is not a major, one-off project that you either ‘do’ or don’t. Rather, it consists of a few good habits that you set up once and then run in the background – much like an alarm system or a fire extinguisher in the office. You didn’t install either of them because you were certain something would go wrong.

If you do just one thing today after reading this article, it should be to enable two-factor authentication on your work email. It takes about ten minutes, it’s free, and it makes a real difference against five of the seven threats listed.

The Hungarian organisations and legislation mentioned in the article are based on publicly verifiable sources. The Sophos survey referred to relates to data from 2023 and covers the Hungarian corporate sector as a whole, not specifically SMEs. This article is for general information purposes only and does not constitute legal advice.

Sources:

KiberPajzs

Cybersecurity Act / NIS2 / SZTFH

NKI

Sophos

Vélemény, hozzászólás?