What Happened? The KRÉTA Data Breach in Brief

In November 2022, the Hungarian news outlet Telex reported that the company developing the KRÉTA system had been hit by a cyberattack, and that a serious data breach may have occurred. The Hungarian Data Protection Authority, known by its abbreviation NAIH, did not delay. The very next day it launched an official inspection and then formal proceedings. The decision closing the case ultimately imposed a data protection fine of 110 million forints on the negligent company.

The story is instructive in itself, but what makes it truly important is that almost all of its mistakes are generalizable. Any company that handles personal data could make them. And these days, practically every company does.

Let’s first look at what was at stake. KRÉTA’s best-known function is the electronic school register, but it also has more than twenty modules, from e-administration to school meals to health data. The system contains the personal data of teachers, students, and parents, including tax identification numbers, social security numbers, and health data. According to the company’s own estimate, the system holds close to 60 million personal data records.

How Did the Attack That Led to the Data Breach Happen?

The story began on 15 September 2022, when unknown perpetrators carried out a phishing attack. One of the company’s customer service employees opened an infected element in a phishing email. With this, the attackers obtained the employee’s passwords and gained access to the system.

And here comes the first big lesson. This employee had every access privilege, to both the test and the live system. On top of that, they regularly saved personal data onto their own computer. At the time of the attack, the complete data set of twelve educational institutions was sitting on their machine.

The employee only alerted management days later. The company replaced the computer, deleted the access privileges, issued new passwords, and considered the matter closed. Then, nearly two months later, came the nasty surprise. The attacker announced on the company’s internal communication channel that they had breached the system. Only then did a more thorough investigation begin, along with the official reporting of the data breach.

The question arises how the system could have been breached again if the passwords had been changed. Two things played a role. One was that the employee stored their login details in their Google account, and Google automatically synced the new passwords too. The other was that through a session left open, the attackers still had access to the Google account, so they easily obtained the new passwords as well.

What Did the Authority Establish About the Data Breach?

According to NAIH, the company breached the law on two counts. First, it failed to take appropriate technical and organizational measures, in other words it did not ensure adequate data security. Second, it did not report the data breach without delay, as the GDPR requires.

The authority split the events into two parts. In the September incident, data leakage was provably established, since the data of twelve institutions was on the employee’s machine. In the November case, all that could be established was that the attackers had been able to access the entire data set. It could not be proven whether they actually downloaded the data.

The Most Important Lessons of the KRÉTA Data Breach for Companies

Now comes the crux, the reason this article is addressed to every business owner. The NAIH decision is essentially a checklist of what not to do. Let’s go through it.

A Data Breach Must Be Reported Without Delay

According to the authority, even the September incident should have been reported, since it was clearly high-risk. Failing to report is in itself a violation. If an incident happens to you, hours count, not days.

Saving Passwords in a Browser Is Risky

Saving sensitive passwords in a Google account or a browser always carries risk. With this volume and this sensitivity of data, it is a serious and unacceptable mistake. There are safer password-manager solutions installed locally on the machine.

Automatic Logout Is Not a Luxury

It was a serious failing that the system did not automatically log out inactive sessions. It was precisely one such session left open that made the second attack possible.

It Does Not Matter Whether the Data Was Actually Used

The company argued in its defense that it could not find the leaked data on the dark web. NAIH rightly disregarded this. The data could be misused at any time in the future, so the absence of actual use does not exempt the company.

A Superficial Investigation Is Not Enough

The investigation of the September attack was not thorough. Deleting accounts and issuing new passwords are not sufficient. A thorough investigation could have prevented the situation from worsening, for example by monitoring network traffic.

Logging Must Be Capable of Uncovering the Incident

The company’s logging did not help to determine what had happened. Since the attacker logged in using the employee’s profile, it was not possible to tell from the log who was present. Logging must be capable of uncovering the incident.

Two-Factor Authentication Is a Baseline, Not an Extra

The company only introduced two-factor authentication after the second attack, in November 2022. For a system of this size, this should have been a minimum requirement from day one.

Human Error and the Importance of Preparation in Preventing a Data Breach

There are two lessons that matter more than all the others, and that are worth carving into the wall.

The first is human error. As the saying goes, only those who do no work make no mistakes. No company can build on the assumption that its employees will never make a mistake. You have to build a security system that can prevent serious consequences even in the event of human error. A single wrong click must not lead to the leak of 60 million data records.

The second is that you have to expect an attack. In certain cases, for example when handling large volumes of or sensitive data, companies are expressly expected to prepare for cyberattacks. The question is not whether there will be an attack, but when, and whether you are prepared for it.

What Can You Do to Avoid a Similar Data Breach?

You might think that all of this only concerns large companies. Unfortunately, that is a mistake. The GDPR applies to a small business with a handful of employees just as much as to a company running a nationwide system. The size of the fine may be smaller, but the violation is established all the same, and the number of data protection inspections grows year by year.

The good news is that most data breaches are preventable. Proper documentation, clear internal rules, two-factor authentication, and basic staff training already make a big difference on their own. It does not require a fortune, only awareness and a little forethought.

If you are unsure whether your company meets the GDPR requirements, or if you do not know what to do in the event of a data breach, it is worth reviewing the situation with an expert. A preventive data protection audit is far cheaper than a fine after the fact, or the loss of a customer’s trust.

If you would like to assess whether your company complies with data protection rules, or you need help handling a data breach, feel free to get in touch. Book a consultation, and together we will review where your company stands.