Hungarian police arrest suspect in cyberattacks on independent media

Hungarian police have arrested a man suspected of carrying out a prolonged series of cyberattacks against independent media outlets in Hungary and abroad, authorities said on Monday.

The 23-year-old suspect from Budapest is accused of launching distributed denial-of-service (DDoS) attacks that disrupted access to at least half a dozen Hungarian news sites beginning in April 2023. The attacks also temporarily took down the website of the Vienna-based International Press Institute (IPI) in September last year, shortly after the organization published a report detailing similar incidents.

According to Hungary’s National Bureau of Investigation, the man allegedly used DDoS-for-hire services and a range of online tools to orchestrate the attacks under the alias “Hano.” Police have not released the suspect’s name, and he has not been formally charged. After questioning, he was released from custody while the investigation continues, reports said.

The cyberattacks intermittently disabled access to Media1.hu and vipcast.hu throughout 2023 and into 2024. Investigators say additional outlets such as HVG, Telex, 444, 24.hu, and Ellenszél.hu were also targeted. 

Officers searched the suspect's home in Budapest earlier in July and seized multiple electronic devices that reportedly contained evidence of his activities. 

The IPI welcomed news of the arrest, calling for a full and transparent investigation into the motive and potential external backing of the attacks.

“There are many questions here that must be answered to secure accountability,” IPI Executive Director Scott Griffen said in a statement. “We urge authorities to identify the motive behind these attacks … and determine whether any external coordination or funding was involved.”

IPI’s website was knocked offline for three days last September following its report on a wave of DDoS attacks targeting 40 Hungarian media outlets. Most of the affected outlets were critical of Prime Minister Viktor Orbán’s government, while pro-government media remained untouched, IPI said.

An independent investigation by the Swedish nonprofit Qurium later confirmed that the IPI attack was likely retaliation for its advocacy work.

Media outlets are frequent targets of cyberattacks, including those driven by political motives.

In June, Russian independent outlets IStories and Verstka were hit by DDoS attacks shortly after publishing an investigation into a child sex trafficking ring allegedly involving oligarchs and other influential figures. 

Last October, Novaya Gazeta Europe, another independent Russian media organization, faced a wave of large-scale DDoS attacks. Ukrainian officials have also reported an increase in Russia-linked cyber campaigns against local media websites since the start of Moscow’s full-scale invasion.