Lyce · Hybrid Watch
hw_cf158109b880d303
Cyber-intrusion of Hungarian geothermal infrastructure attributed to Russia-linked hacker group.
A cybersecurity report published in July 2025 indicates that a hacker group named “SECTOR16,” believed to have Russian origin or Russian-state links, infiltrated a Hungarian geothermal heat-generation plant’s control network. According to the article, the attackers gained access to Supervisory Control and Data Acquisition (SCADA) systems controlling fans, compressors, temperature sensors and emergency shut-off protocols for the facility. The geothermal facility serves both civilian heating and industrial pre-heating functions — meaning its disruption could affect dual-use and critical infrastructure. The breach was not publicly described as causing a major blackout or explosion, but Hungarian cybersecurity officials classified it as “serious” given the access level achieved. Some sections of the plant were taken offline as a precaution while forensic teams reviewed logs and hardened defences. The Hungarian government did not publicly name the attacker as Russia, but the technical fingerprint and attribution report referenced Russian-origin infrastructure and prior Russian-linked operations in the region.
E/M/R/S scores
- EExistence0/4 · Not assessed
- MIntent0/4 · Not assessed
- RRussian actor link0/4 · Not assessed
- SRussian state responsibility0/4 · Not assessed
Facts
No facts
Sources
-
- Role
- discovery_lead
- Date
- 2025-07-09T22:00:00Z
A cybersecurity report published in July 2025 indicates that a hacker group named “SECTOR16,” believed to have Russian origin or Russian-state links, infiltrated a Hungarian geothermal heat-generation plant’s control network. According to the article, the attackers gained access to Supervisory Control and Data Acquisition (SCADA) systems controlling fans, compressors, temperature sensors and emergency shut-off protocols for the facility. The geothermal facility serves both civilian heating and industrial pre-heating functions — meaning its disruption could affect dual-use and critical infrastructure. The breach was not publicly described as causing a major blackout or explosion, but Hungarian cybersecurity officials classified it as “serious” given the access level achieved. Some sections of the plant were taken offline as a precaution while forensic teams reviewed logs and hardened defences. The Hungarian government did not publicly name the attacker as Russia, but the technical fingerprint and attribution report referenced Russian-origin infrastructure and prior Russian-linked operations in the region.