Oxygen Forensics software: police suspended it, NAV continued to use it
The Russian-backed Oxygen Forensics forensic software has been suspended by Hungarian police, whilst the National Tax and Customs Administration confirmed its continued use earlier.
Software suspended at police, earlier active use at NAV
The Oxygen Forensics digital forensic software "is currently not operational for information security reasons" among Hungarian law enforcement agencies, according to a statement from the National Police Headquarters Communications Service to economx.hu. The statement came after the United States Department of Justice initiated criminal proceedings on 23 September 2026 against the company's executives behind the software.
Economx.hu also asked whether the Ministry of Interior and its subordinate agencies were aware of the Oxygen Forensics' Russian ownership and development background before the Americans made it public, and if so, when and from what source.
Acquired via public procurement for 10.1 million forints
The police statement revealed that the software was procured as a result of an open tender procedure in 2024 for the National Investigation Office of the Rapid Response Police. The procedure was conducted by the Defence Procurement Agency Ltd. The contract was valid from 7 January 2025 to 10 March, with a net value of 10.1 million forints. The relevant documents are still accessible in the Electronic Public Procurement System.
According to the Hungarian distributor's product description, Oxygen Forensic Detective is a multifunctional platform designed to extract, decode and analyse data from mobile and IoT devices, SIM and memory cards, drones and cloud services, and is also capable of recovering authentication credentials from Windows, macOS and Linux systems.
NAV confirmed earlier use
The Ministry of Finance responded substantively to the matter first. The ministry led by András Kármán confirmed to economx.hu that the National Tax and Customs Administration uses Oxygen's digital forensic solution and continuously monitors information appearing in connection with the software.
"Regarding the issue, the NAV continuously tracks data and information that arise on the subject and, responding to any emerging security risks, immediately takes the necessary measures," the ministry stated in mid-October.
The ministry added that there is currently no data to suggest that the use of Oxygen itself poses a security risk, and there is no evidence of malicious code or unauthorised data access. It also stated that much of the Hungarian use took place without an internet connection.
Present in authorities for years
Economx.hu previously revealed on the basis of public procurement documents that Oxygen Forensic Detective was not a new tool for Hungarian authorities. In a 2022 NAV tender, nine licences were already included, with an original expiry date of 4 August 2022 – meaning the software had been in use at the office before that. In 2025, the NAV extended seven licences for a further two years; the tender was won by Lenár Ltd. with a net bid of 22.295 million forints. According to the documentation, the software was procured for forensic data recovery, partial analysis and backup of cloud data stores on mobile phones.
Oxygen also appeared at the police: according to the National Police Headquarters' public contract list, at the end of 2024 they concluded a 10.14 million forint IT contract with Lenár Ltd., which included Oxygen Forensics Detective along with AccessData FTK and X-Ways Forensic software.
Background to the American indictment
The matter attracted international attention after the United States Department of Justice initiated criminal proceedings in September against the company's executives. According to the charge, the company registered in Virginia presented itself in the United States as an American-owned and American-developed business, whilst it was actually owned and controlled by five Russian citizens through a Cypriot holding company, with development work largely taking place in Russia.
The American prosecution does not allege that Oxygen software itself contained malicious code or backdoors, nor that the company gained unauthorised access to clients' systems. The matter is particularly sensitive because another company within the circle of Oxygen's Russian owners sold products built on the same technological basis to the Russian Federal Security Service, the Investigative Committee and the Russian Interior Ministry.
Source: Google News HU — Crime (hu)