22.07.2025

On 21 July, the Hungarian National Investigation Bureau’s Cybercrime Investigation Unit announced that they had raided the home of a 23-year-old man suspected of carrying out the distributed denial-of-service (DDoS) attacks and confiscated numerous digital devices.

 

Police said the man, whose identity has not been revealed, is the cyberattacker known as Hano, who was identified as coordinating attacks on media websites in Hungary, as well as IPI. He was arrested and questioned on 9 July on suspicion of the crime of information system or data breach, according to authorities.

 

Formal charges have yet to be brought while police continue to assess digital evidence, and he has since been released from custody. Hungarian authorities added that evidence was found on the seized devices that clearly indicated the commission of the digital crimes.

 

“IPI welcomes the announcement of the arrest by Hungary’s Cybercrime Investigation Unit of the individual suspected to be the cyber attacker known as Hano,” said IPI Executive Director Scott Griffen. “We await further details on the investigation and planned charges. There are many questions here that must be answered to secure accountability. We urge authorities to clearly identify the motive behind these attacks as well as to fully and transparently investigate and determine whether any external coordination or funding was involved in these targeted attacks on independent media and civil society.”

 

IPI’s website was first hit by a DDoS attack on 1 September 2023, just days after we published a report detailing how at least 40 different media websites in Hungary had been hit by DDoS attacks, a form of cyberattack which crashes websites by overloading their servers with millions of simultaneous access requests. The majority of these attacks were directed against independent media platforms, including HVG, Telex, 444.hu, Magyar Hang, and Népszava, while pro-government media were left unscathed.

 

The attack kept IPI’s website offline for three days while our IT team fought to repel waves of attacks. An in-depth forensic analysis conducted in December 2023 by the Qurium, a non-profit based in Sweden, confirmed IPI’s initial assessment that the DDoS attack was carried out in retaliation for our work in support of independent media in Hungary.

 

Hungarian authorities said the man was identified by the Cybercrime Investigation Unit via digital traces and fake profiles. An analysis of access logs and examination of network traffic showed the perpetrator had used so-called “DDoS for hire” services and other online tools to carry out the attacks, which were executed under the name Hano – which he also used on service provider interfaces and in personal messages.

 

After it reported on the attack on IPI, the German newspaper taz was also hit by a similar attack a week later, mirroring a pattern of reprisals for media reporting on the DDoS attacks. Analysis of technical logs from the attacks on taz and IPI both show how the hacker used the nickname Hano – an acronym in Hungarian for a disorder which affects the human body. During many attacks, messages were left behind in the code, such as #HanoHatesU. The same message was left in the code of attacks on Hungarian media outlets, which continued in 2024.

 

Experts taz spoke to unofficially classified Hano as an Advanced Persistent Threat (APT) – defined by the German Cybersecurity Agency as a well-trained, usually state-sponsored attacker who targets a system over a long period of time.

 

The Hungarian police report specifically mentions the attacks on IPI, which led authorities in Budapest to contact Austrian authorities due to the cross-border scope of the investigation.

 

IPI reported the case to Austrian police at the time and sent information to the Hungarian Cybercrime Investigation Unit in April 2025. IPI will be contacting Hungarian and Austrian law enforcement agencies to request further information.

 

“Cyber attacks pose a growing threat to press freedom worldwide, severely harming the public’s right to news and information. It is essential that law enforcement authorities take these attacks seriously whenever they occur and ensure full accountability for all those involved.”

In the wake of the attacks, IPI worked with Cloudflare to provide free digital security tools to a number of Hungarian media to help them defend against future DDoS attacks. If you are a media outlet in need of support in repelling DDoS attacks, IPI can provide referrals for enhanced defences free of charge. Please contact IPI for more information.

This statement was coordinated by IPI as part of the Media Freedom Rapid Response (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States and Candidate Countries.

16 May 2025

Draft legislation submitted on May 13 by the Fidesz party of Prime Minister Viktor Orbán represents the most serious attack on Hungarian media in years and is the latest step in a more than decade-long campaign by the government to stigmatise independent journalism, undermine its business model and systematically erode media pluralism.

 

If passed, this legislation would effectively represent the first foreign agent-style law in the European Union, marking another milestone in Hungary’s democratic decline and deepening the crackdown in what has long been the EU’s worst country for media freedom.

 

The proposed law poses a direct threat to core EU values of media freedom and media pluralism as set forth in the EU’s Charter of Fundamental Rights. In targeting funding for media from within the EU, it stands in direct contrast to the vision of the EU as a shared community and single market. This autocratic legislation would grant a foothold for Russian-style strangling of independent media from within the bloc itself.

 

With the bill likely to become law in the coming weeks, our organisations today urge the European leaders and the EU Council to recognise the serious threat posed by this law for both Hungary and the EU and to discuss all possible measures to address the Orban’s government’s fundamental threat to democracy of both the Member State and the bloc itself.

 

The bill, entitled “On the Transparency of Public Life”, would grant the Sovereignty Protection Office (SPO) powers to recommend that any foreign funded legal entity, including media outlets or NGOs, be added to a government blacklist if it deems they pose a threat to the country’s sovereignty.

 

A media outlet added to the list would be blocked from receiving any form of grant or donation or financial transfer from any foreign entity or state. This would include any grants from the European Union or any EU Member State, as well as countries outside the bloc. A media outlet would only be able to receive an exemption for foreign funding with the permission of the Hungarian anti-money laundering authority.

 

If a media outlet does not comply with these rules, the money laundering authority would have powers to impose a fine of 25 times the amount of funding they received, payable within 15 days, which could financially destroy a smaller media company. If blacklisted media is deemed to have committed a repeat funding offence it could face closure, opening the door for the government to legally shut down independent media houses. The bill also includes a provision which would permit the money laundering authority to retroactively assess whether a media outlet served the agenda of a foreign donor and then order the funds to be returned.

 

The SPO would also be handed new powers to conduct searches of newsrooms and access documents or computer files, with the assistance of police. Banks would be obliged to monitor the financial activity of blacklisted media houses, provide information on their transactions. They would be barred from citing banking secrecy to refuse to comply with these orders. Meanwhile, the executives, founders and potentially the editors of a blacklisted media outlet would be forced to declare their assets to the national tax office, in the same way as a public figure or politician.

 

In a further threat to the funding model for independent journalism in Hungary, any entity added to the blacklist would lose its eligibility to receive a 1% annual tax donation from citizens as is currently the case in Hungary. The voluntary donation from readers to media houses which run a charitable foundation currently represents a financial lifeline for many media critical of the government, which have been systematically excluded from state advertising budgets and other state funds. This tax rule would come into effect one year after the law is adopted. All other rules would come into effect three days after adoption of the law.

 

While the bill does not mention media directly, its scope involves any legal entity registered in Hungary which carries out activities capable of influencing public opinion or democratic debate, meaning it is essentially targeted at news media and civil society organisations. Broad criteria possible for blacklisting could include any reporting which the SPO deems as “undermining Hungary’s independent, democratic and rule-of-law-based character”, violating Hungary’s constitutional identity or Christian culture or challenging the primacy of marriage, the family and biological sexes. This could lead to increased self-censorship of media covering these topics.

 

These powers would be handled by the Sovereignty Protection Office, a body established in 2023 and headed by a Fidesz loyalist. Our organisations have previously documented the body’s discriminatory and politically motivated stigmatisation of media receiving foreign funds. The SPO is currently being challenged in front of the European Court of Justice but continues its operations. The current bill represents a major strengthening of its powers and broadens its ability to harass and potentially even close media outlets based on its arbitrary assessments.

 

In practical terms, if adopted the impact of the bill on the financial sustainability of a major segment of Hungarian independent media would be severe. A number of predominantly online media which receive European grants for different projects such as cross border investigative reporting could be badly affected. Other media which cover LGBTQ topics would likely be forced to self-censor to avoid retaliation. The impact on other remaining bastions of free press in Hungary which have foreign ownership or foreign subscriptions, remains unclear. Blacklisting could realistically drive media or individual journalists into exile. Overall, the bill contains even more damaging provisions than our organisations had previously feared.

 

The response of the EU to such a direct violation of European law and the threat to fundamental rights and treaty values must be swift and forceful. Given the likely implementation of the law in a rapid parliamentary process, we call on the European Commission to immediately begin assessing the non-compliance of the draft bill with EU law in preparation for an immediate investigation and challenge at the ECJ, if the bill is adopted. This process should be carried out in an expedited time frame to limit the potential damage to what remains of the country’s independent media landscape. Until the Court is able to rule, the Commission should also be ready to apply immediate interim measures against Hungary.

 

It should also be noted that the proposed law is also much harsher than Hungary’s 2017 Law on Transparency, which was subsequently condemned by the European Court of Justice (ECJ) in a 2020 ruling as a breach of EU law for its restrictions in free movement of capital, failure to protect right to private and family life and restrictions on the right to freedom of association. The European Council is also due to discuss the Rule of Law Procedure against Hungary at its forthcoming meeting on 27 May, where under Article 7(1) Hungary is deemed as being at risk of a serious breach of EU values. EU leaders should condemn the draft bill and signal the strongest possible opposition to the bill and its impact on Hungarian and EU democracy.

 

Any failure by the EU to urgently address this law as a flagrant attack on media freedom and media pluralism would inspire allies in Slovakia and elsewhere to develop similar attacks on independent media which receive foreign grants. While the European Media Freedom Act due to come into effect in August 2025 represents a much-needed initiative to safeguard free and pluralistic media across the bloc, the EU Commission has not always utilised all tools at its disposal to push back against the steady erosion of media pluralism in Hungary, most glaringly the failure to take up multiple state aid complaints over the government’s abuse of EU money to subsidise pro-government media. The same mistake must not be made again.

 

Moving forward, our MFRR partner organisations continue to stand by all independent media and civil society organisations in Hungary and will be conducting advocacy at the EU and other international bodies.

This statement was coordinated by the Media Freedom Rapid Response (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States and Candidate Countries.