Ransomware group claims breach of pro-Orbán Hungarian media firm

A cyber-extortion group said it was responsible for a recent ransomware attack on Hungarian media company Mediaworks that resulted in the publication of large volumes of stolen data online.

The World Leaks group said they released nearly 8.5 terabytes of allegedly sensitive files on their dark web site last week. Local media outlets that reviewed the material said it included payroll records, contracts, financial statements and internal communications.

Mediaworks confirmed the incident on Friday, warning that “a significant amount of illegally obtained data may have come into the possession of unauthorized persons,” and said it had launched an investigation.

The company also urged journalists not to report on the leaked material, arguing that using such data could constitute a criminal offense.

“The illicit acquisition of data is a crime, and the use, processing, transmission, or disclosure of data obtained in this way, in any form, is also considered a crime,” the company said.

Despite the warning, several independent local media outlets reported that the leaked documents included notes from a January 2025 Mediaworks editorial meeting suggesting that someone would “contact Moscow for help” regarding articles discrediting Ukrainian President Volodymyr Zelensky.

Following the publication, Hungarian outlet Media1 said Mediaworks threatened legal action and asked it to remove the article.

“Despite the threat, we will not comply with the censorship attempt, as in our opinion the request is unfounded,” Media1 said in a statement, arguing that the information is of public interest, particularly given Hungary’s political alignment under Prime Minister Viktor Orbán and the country’s contentious stance toward Russia during the war in Ukraine.

Recorded Future News could not independently verify the authenticity of the leaked data or the reported memo.

Mediaworks operates dozens of newspapers, regional dailies, magazines and online outlets, and is widely seen as part of a pro-government media ecosystem aligned with Orbán’s allies. Orbán recently lost the national election to the opposition party.

World Leaks, the group behind the attack, emerged in early 2025 as a rebrand of the Hunters International ransomware operation. Unlike traditional ransomware gangs, it focuses on data theft and extortion — threatening to publish sensitive information rather than encrypting victims’ systems.

The group has primarily targeted organizations in the United States but has also hit companies across Europe, India and Canada. The Mediaworks breach appears to be its first known operation in Hungary.

The company has faced cyber incidents before. In 2022, the hacktivist collective Anonymous defaced several Hungarian government-affiliated news sites, including Mediaworks outlets, accusing them of serving as propaganda tools for Orbán’s pro-Kremlin policies.