Hungary: Police arrest suspect behind DDoS cyberattacks on IPI and independent media websites

22.07.2025

On 21 July, the Hungarian National Investigation Bureau’s Cybercrime Investigation Unit announced that they had raided the home of a 23-year-old man suspected of carrying out the distributed denial-of-service (DDoS) attacks and confiscated numerous digital devices.

 

Police said the man, whose identity has not been revealed, is the cyberattacker known as Hano, who was identified as coordinating attacks on media websites in Hungary, as well as IPI. He was arrested and questioned on 9 July on suspicion of the crime of information system or data breach, according to authorities.

 

Formal charges have yet to be brought while police continue to assess digital evidence, and he has since been released from custody. Hungarian authorities added that evidence was found on the seized devices that clearly indicated the commission of the digital crimes.

 

“IPI welcomes the announcement of the arrest by Hungary’s Cybercrime Investigation Unit of the individual suspected to be the cyber attacker known as Hano,” said IPI Executive Director Scott Griffen. “We await further details on the investigation and planned charges. There are many questions here that must be answered to secure accountability. We urge authorities to clearly identify the motive behind these attacks as well as to fully and transparently investigate and determine whether any external coordination or funding was involved in these targeted attacks on independent media and civil society.”

 

IPI’s website was first hit by a DDoS attack on 1 September 2023, just days after we published a report detailing how at least 40 different media websites in Hungary had been hit by DDoS attacks, a form of cyberattack which crashes websites by overloading their servers with millions of simultaneous access requests. The majority of these attacks were directed against independent media platforms, including HVG, Telex, 444.hu, Magyar Hang, and Népszava, while pro-government media were left unscathed.

 

The attack kept IPI’s website offline for three days while our IT team fought to repel waves of attacks. An in-depth forensic analysis conducted in December 2023 by the Qurium, a non-profit based in Sweden, confirmed IPI’s initial assessment that the DDoS attack was carried out in retaliation for our work in support of independent media in Hungary.

 

Hungarian authorities said the man was identified by the Cybercrime Investigation Unit via digital traces and fake profiles. An analysis of access logs and examination of network traffic showed the perpetrator had used so-called “DDoS for hire” services and other online tools to carry out the attacks, which were executed under the name Hano – which he also used on service provider interfaces and in personal messages.

 

After it reported on the attack on IPI, the German newspaper taz was also hit by a similar attack a week later, mirroring a pattern of reprisals for media reporting on the DDoS attacks. Analysis of technical logs from the attacks on taz and IPI both show how the hacker used the nickname Hano – an acronym in Hungarian for a disorder which affects the human body. During many attacks, messages were left behind in the code, such as #HanoHatesU. The same message was left in the code of attacks on Hungarian media outlets, which continued in 2024.

 

Experts taz spoke to unofficially classified Hano as an Advanced Persistent Threat (APT) – defined by the German Cybersecurity Agency as a well-trained, usually state-sponsored attacker who targets a system over a long period of time.

 

The Hungarian police report specifically mentions the attacks on IPI, which led authorities in Budapest to contact Austrian authorities due to the cross-border scope of the investigation.

 

IPI reported the case to Austrian police at the time and sent information to the Hungarian Cybercrime Investigation Unit in April 2025. IPI will be contacting Hungarian and Austrian law enforcement agencies to request further information.

 

“Cyber attacks pose a growing threat to press freedom worldwide, severely harming the public’s right to news and information. It is essential that law enforcement authorities take these attacks seriously whenever they occur and ensure full accountability for all those involved.”

In the wake of the attacks, IPI worked with Cloudflare to provide free digital security tools to a number of Hungarian media to help them defend against future DDoS attacks. If you are a media outlet in need of support in repelling DDoS attacks, IPI can provide referrals for enhanced defences free of charge. Please contact IPI for more information.

This statement was coordinated by IPI as part of the Media Freedom Rapid Response (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States and Candidate Countries.