Cyberattacks are undermining independent media in Hungary

In April 2023, the Hungarian independent news site Media1, known for its coverage of media affairs, was abruptly taken offline by a distributed denial-of-service (DDoS) attack. This type of cyber assault overwhelms servers with a flood of simultaneous access requests, rendering websites inaccessible for extended periods.

Although Media1 had previously endured both minor and more serious digital intrusions, the intensity of this particular wave was unprecedented. At its peak, the outlet was incapacitated for days, and their Hungarian internet service provider informed them that the attacks were starting to clog their own upstream provider’s network, and could no longer continue the service.

A coordinated campaign

Media1 was not alone. That same month, more than 40 Hungarian media platforms were hit by similar assaults, including prominent names such as Telex, HVG, and 444. The selection of targets appeared deliberate: all were independent and critical of Prime Minister Viktor Orbán’s administration.

The threat grew in frequency and impact over the following months, causing persistent disruption across the independent press. Still today, cyberattacks remain a significant obstacle to free journalism in Hungary. While no definitive pattern has emerged, some media leaders have observed a troubling correlation. Márton Kárpáti, CEO of Telex, told The Fix that attacks often coincide with major news events. “The last wave occurred just as the Budapest Pride march, banned by the government, was about to begin,” he noted.

Dániel Szalay, editor-in-chief of Media1, echoed this observation: “The incidents consistently followed the publication of critical stories about the Orbán regime, such as our reports on journalists being barred from government press conferences, or the enrichment of pro-government propagandist Philip Rákay.”

Although not among the Hungarian outlets first targeted by cyberattacks in 2023, investigative journalism media Direkt36 faced a concentrated wave of DDoS assaults earlier this year. The disruption lasted several days and came shortly after the release of their longform documentary The Dynasty, which explored the financial rise of Prime Minister Viktor Orbán’s family, and was a huge hit with Hungarian audiences.

“But we have no way of telling if the timing was deliberate,” Péter Nádori, Chief Operating Officer of Direkt36, told The Fix. In response to the attack, the outlet had to temporarily restrict international access and transitioned to a more advanced cloud-based security infrastructure to safeguard its operations.

Defences begin to hold

The toll of cyberattacks to independent press is far reaching, and deeply disruptive. Szalay recalled his experience at Media1: “advertising revenue took a hit, relocating servers brought additional costs, while day-to-day operational expenses surged.” Besides the financial impact, there were also personal consequences.

“These experiences heavily affect your mental health. Imagine publishing an investigative piece, only to see your site crash minutes later due to an attack. Not to mention family plans and holidays that were ruined because we needed to coordinate with system administrators to keep the site online." Szalay calculates the cumulative damage over the years to be in the tens of millions of forints, around €50,000.

The financial strain is not unique to Media1. Nádori estimated that following the most recent wave of attacks, at Direkt36 web hosting and IT security expenses have nearly doubled compared to the previous year. It’s a burden that independent outlets in Hungary can no longer avoid. For the CEO of Telex the stakes are clear: “Keeping the site online is crucial for our operation, and we have to do whatever it takes, no matter the cost.”

On the positive side, the benefits are starting to become visible. “When we first experienced such threats at Telex, we weren’t well prepared,” Kárpáti  admitted. “We had several hours of downtime over a three-day period.” Since then, the outlet has implemented stronger security protocols. Although the frequency and intensity of assaults remain unchanged, still occurring monthly for shorter periods, their impact has lessened thanks to these new safeguards.

A form of digital censorship

While pro-government media in Hungary have occasionally been subjected to cyberattacks, the scale of these incidents are significantly less severe than those faced by independent outlets. Moreover, when attacks target government-aligned platforms, ruling party officials are swift to issue public condemnations.

In 2022, several right-wing and conservative news platforms aligned with the government were hit by hackers claiming affiliation with Anonymous. The group justified the attacks by accusing the outlets of supporting Russia’s invasion of Ukraine. At the time, then Justice Minister Judit Varga issued a strong public condemnation of the DDoS campaign. In contrast, no government official has spoken out against the sustained digital assaults on independent media.

This disparity has drawn criticism from international watchdogs. Scott Griffen, Deputy Director of the International Press Institute (IPI), described the wave of DDoS threats as an insidious form of digital censorship, urging authorities and law enforcement to take the issue seriously and launch investigations. So far, those appeals have gone largely unanswered.

Tracing the attackers

No one has claimed responsibility for the cyberattacks, but the perpetrator or perpetrators appear to operate under the alias HANO, a Hungarian acronym for a rare medical disorder. Traces of Hungarian-language messages were embedded in the attack code, and the specific knowledge of the Hungarian media landscape indicates that some locals were involved.

In response to the escalating threat, Media1 relocated its servers to France and asked IT security specialists to set digital traps to identify the source. The strategy paid off. In January 2024, the outlet submitted a report to the police cybercrime unit, armed with key evidence including the attacker’s IP address and internet service provider. Yet the investigation was mishandled from the beginning. “I don’t know why, but the case was initially downgraded,” remembered Szalay. “It was handed off to a small police district, where I had to explain what an IP address is.” Only after considerable delay did the Police Cyber Protection Department take control.”

Szalay was confident he had identified the individual behind the alias HANO, but it wasn’t until July 2025, nearly 18 months after he had provided such evidence, that authorities conducted a house search. A 23-year-old man from Budapest has since been charged with targeting Hungarian media outlets and the website of the International Press Institute (IPI). “Police footage shows a router clearly labeled as belonging to a DIGI customer, confirming one of the pieces of evidence we submitted,” Szalay noted.

Launching a DDoS attack can be relatively inexpensive, often relying on rented botnets or “DDoS-as-a-service” platforms available on the dark web. But in the case of HANO, the scale was anything but ordinary. “He targeted at least 50 different portals, many of them repeatedly, over extended periods, even weeks,” said Szalay. “In some cases, millions of requests flooded the sites within seconds.”

The intensity was such that not only did the targeted servers collapse, but several internet providers and network nodes, including BIX, the Budapest Internet Exchange, suffered serious overload. Szalay is convinced that, given the scale, frequency, and technical sophistication, significant financial resources were involved. But in Hungary's illiberal political climate, whether the police will uncover the possible political ties behind these attacks or trace where these vast sums of money came from, is still to be seen.

A threat to democracy

Szalay remains concerned by the authorities’ dismissive response. Despite the BIX outage disrupting the Hungarian internet, the incident wasn’t treated as a national security threat. In a country where past DDoS campaigns have silenced dozens of independent media outlets in one coordinated assault, the risk of cyberattacks timed to suppress coverage during pivotal moments is a real threat to democracy. This is especially troubling as Hungary heads into what may be its most unpredictable election in a decade next spring.

Source of the cover photo: Oleksandr Chumak via Unsplash