Why government websites are so easy to hack: Kamil Szczurowski & Robert Kruczek (Securitum) @ DefCamp 2026
This year’s fast-approaching DefCamp edition set out to shed light on the ever-changing landscape of cybersecurity, exploring some of the most pressing and concerning threats facing the digital world today.
Luckily for us, Kamil Szczurowski and Robert Kruczek, two of Poland’s most renowned ethical hackers have agreed to join us for an exclusive interview. Beyond introducing their talks at DefCamp, they offered a glimpse into their reasoning for hacking half the Polish government, the challenges they encountered and the security measures they recommended.
Robert and Kamil work as ethical hackers for Securitum, Poland’s leading cybersecurity firm while also contributing to sekurak.pl, the country’s largest information security portal. With years of experience in the cybersecurity conference field, they have graced the stages of some of the most prominent cybersecurity events, such as DEF CON.
When we sent them our questions in end August, they had just returned from this year’s DEF CON, where they shared their ideas with tens of thousands of cybersecurity enthusiasts from all around the world. Yet stepping in front of such a broad audience didn’t seem to faze them at all. As they told us, it didn’t feel much different from the other conferences they’ve spoken at, with “no major stress, basically zero stress to be honest.” That same calm, matter-of-fact attitude runs through their entire story, starting with how two friends ended up hacking half a government.
How do you end up hacking half a government?
That's obviously quite a long story. We used to spend some of our spare time playing different games together. One day we thought that it wasn't exactly the best way to utilise our free time and skills, and decided to check the security of government websites. We checked one piece of software and noticed that it contained a few obviously visible vulnerabilities, then found another piece of software, and then another and another. The rest is history, and obviously you can hear about it at our talk.
Their work as ethical hackers brings them neither money nor fame, and as they’ve said in previous interviews, neither of those interests them. So what keeps them going, and why the Polish government in particular? Part of the answer is that the work itself is surprisingly quick: most vulnerabilities are found in minutes, not hours, so it’s far from a full-time job. As for their motivation, they admit it’s hard to pin down exactly, but it comes down to using their time and skills “for a greater good,” especially when it concerns their own country’s safety. Of course, doing good doesn’t always mean being welcomed with open arms.
Although your work has undoubtedly strengthened the digital infrastructure of Poland, have you ever been met with distrust? What are the biggest obstacles you have faced?
Certainly! There were quite a few cases where we initially reached out to the vendor and weren't taken seriously or didn't receive an answer at all. Luckily, in each of those cases, we could always contact CERT Polska, which would coordinate the disclosure of the vulnerability. The biggest obstacle would always be a lack of initiative from the vendors who did not treat the reported vulnerabilities seriously or treated them as a nuisance.
Still, their persistence is starting to pay off. Polish public institutions are already showing signs of change, such as the migration away from PAD CMS, a system the duo has flagged many times. They’re optimistic about what lies ahead, noting that “the future’s definitely looking brighter,” though they’re realistic that this kind of change simply takes time. Which raises a bigger question: what can other countries learn from Poland’s experience?
Based on your experience, what advice would you give to governments in other countries that want to strengthen their cybersecurity? If you could recommend just one priority, what would it be and why?
We believe that the best advice is basically to follow the known security principles that, among many things, include periodic testing of the organisation.
Their expertise goes beyond finding vulnerabilities. In one of their articles on disk encryption, they discussed protection and incident-response measures such as performing a memory dump. But when it comes to organisations working with a limited budget, their advice is refreshingly simple: start with a proper backup policy, including disaster recovery simulations, before an incident ever happens, and then carry out disaster recovery if a serious incident does occur. In their view, this is “the easiest and the cheapest solution” against data loss, and it protects not only against cyberattacks but also against everyday risks like hardware or software failures.
As Robert and Kamil have shown, the most common vulnerabilities are rarely deeply hidden. More often, they exist in plain sight, sometimes even ignored by the very vendors responsible for fixing them.
Their story is a reminder that strong cybersecurity often starts with the basics: periodic testing, taking vulnerability reports seriously, and reliable backups, particularly when it comes to protecting critical public infrastructure and services.
Want to hear the full story of how two friends ended up hacking half a government? Catch Kamil and Robert live on stage at DefCamp 2026 this November in Bucharest.
Meet the interview author:
Daria Niculescu is a computer engineering student at POLITEHNICA Bucharest who brings together her love for arts, literature and ethical hacking. She is passionate about secure programming, embedded systems and low-level vulnerability research, and enjoys competing in CTFs.