Hungarian Police Arrest DDoS Suspect Targeting Independent Media as Global Attacks Surge
Major Breakthrough in Media Freedom Case
Hungarian police have made a significant arrest in their investigation of prolonged cyberattacks against independent media outlets, apprehending a 23-year-old Budapest resident suspected of orchestrating distributed denial-of-service (DDoS) attacks against news organizations both domestically and internationally. The arrest, announced on Monday, represents a crucial development in a case that has threatened media freedom across Europe for over two years.
The suspect allegedly conducted sustained DDoS campaigns targeting independent media websites, effectively silencing critical journalism through technical means. Hungarian authorities have not released the individual's name, but investigations suggest the attacks may be connected to an individual known by the online handle "Hano," who has been linked to similar campaigns since April 2023.
Breached Company
Pattern of Attacks Against Press Freedom
The arrest comes after an extensive pattern of cyberattacks that has specifically targeted media outlets critical of the Hungarian government. Since April 2023, at least 40 media websites in Hungary have faced DDoS attacks, including prominent independent outlets such as Media1, Kecsup, Telex, HVG, 444.hu, Magyar Hang, and Népszava.
The attacks have not been limited to Hungarian media. International press freedom organizations have also been targeted, including the Vienna-based International Press Institute (IPI) and German newspaper taz, which experienced a sophisticated DDoS attack that crashed its website for over two hours during Germany's federal election coverage in February 2025.
The timing and targeting of these attacks suggest a deliberate strategy to undermine independent journalism. One particularly concerning incident involved an Eastern European news outlet being attacked immediately following its coverage of a local Pride parade, demonstrating how these cyber weapons are being used to suppress specific types of reporting.
Technical Sophistication and Impact
The DDoS attacks attributed to the suspect represent more than simple digital vandalism. These campaigns involved sophisticated, sustained efforts designed to overwhelm news websites with traffic, rendering them inaccessible to readers during crucial news cycles. The attacks have evolved in complexity over time, with February 2025's assault on taz described as "larger and more sophisticated" than previous incidents.
Analysis of technical logs from multiple attacks revealed consistent patterns and methodologies, helping investigators connect the incidents and ultimately leading to the arrest. The International Press Institute had been calling for Hungarian cybercrime police to investigate these attacks since May 2025, highlighting the cross-border nature of the threat.
Breached Company
Global DDoS Attack Surge
This arrest occurs against the backdrop of an unprecedented surge in DDoS attacks worldwide. According to Cloudflare's latest threat report, HTTP-based DDoS attacks increased by 129% year-over-year in the second quarter of 2025, underscoring the growing scale of this cyber threat.
The global DDoS landscape has reached alarming proportions. Cloudflare blocked 7.3 million DDoS attacks in Q2 2025, and while this represents a decline from the record 20.5 million attacks blocked in Q1 2025, the individual attacks have become far more powerful. The company recorded the largest DDoS attack in history during Q2 2025, peaking at 7.3 terabits per second (Tbps) and 4.8 billion packets per second.
Particularly concerning is the 592% increase in "hyper-volumetric" DDoS attacks exceeding 100 million packets per second compared to the previous quarter. Additionally, ransom DDoS attacks—where attackers demand payment to stop their assault—increased by 68%.
Breached Company
Media Freedom Under Digital Assault
The Hungarian case exemplifies a troubling global trend where authoritarian actors and cybercriminals are weaponizing DDoS attacks to silence independent journalism. Unlike traditional forms of media suppression, these digital attacks can be launched remotely, are difficult to trace, and can effectively neutralize news outlets during critical reporting periods.
The targeting appears deliberately focused on outlets that provide critical coverage of government activities, suggesting these attacks serve as a form of digital censorship. The fact that international press freedom organizations have also been targeted indicates an attempt to suppress not just local reporting, but broader advocacy for media freedom.
June 2025 emerged as the busiest month for DDoS attacks in the second quarter, accounting for nearly 38% of all observed activity globally. This surge coincides with various political events and suggests coordinated efforts to disrupt information flow during sensitive periods.
Law Enforcement Response and Challenges
The Hungarian arrest represents a significant victory for law enforcement agencies struggling to combat cybercrime that crosses international borders. However, the case also highlights the challenges authorities face in investigating these attacks. The investigation has been ongoing since at least 2023, and it took extensive technical analysis and international cooperation to identify and apprehend the suspect.
The cross-border nature of these attacks complicates prosecution efforts. While the suspect was arrested in Hungary, the attacks targeted media outlets across multiple European countries, requiring coordination between different legal systems and jurisdictions.
Breached Company
Broader Implications for Cybersecurity
This case underscores several critical issues in the current cybersecurity landscape. First, it demonstrates how DDoS attacks have evolved from nuisance activities by amateur hackers to sophisticated tools of political and economic warfare. Second, it highlights the particular vulnerability of independent media organizations, which often lack the robust cybersecurity infrastructure of larger corporations.
The technical sophistication of modern DDoS attacks requires equally sophisticated defenses. Many news organizations, particularly smaller independent outlets, may not have the resources to implement comprehensive DDoS protection, making them attractive targets for attackers seeking maximum impact with minimal risk.
Moving Forward
The arrest in Hungary provides hope that law enforcement agencies are developing the capabilities needed to investigate and prosecute cybercriminals who target media freedom. However, the broader trends revealed by Cloudflare's data suggest that DDoS attacks will continue to be a significant threat to digital infrastructure and democratic institutions.
Media organizations must recognize that cybersecurity is now a fundamental requirement for protecting press freedom in the digital age. This includes implementing DDoS protection services, developing incident response plans, and building relationships with cybersecurity experts and law enforcement agencies.
The international nature of these threats also demands enhanced cooperation between countries and organizations. The success of the Hungarian investigation appears to have benefited from coordination with international partners, suggesting a model that could be applied to future cases.
As DDoS attacks continue to grow in frequency and sophistication, the arrest of this suspect represents both a victory for media freedom and a reminder of the ongoing challenges facing independent journalism in an increasingly connected world. The case serves as a crucial precedent, demonstrating that those who use cyber weapons to silence the press can be identified, arrested, and held accountable for their actions.
The convergence of rising global DDoS attacks and targeted campaigns against independent media creates an urgent imperative for stronger cybersecurity measures and international cooperation to protect the digital infrastructure that underpins modern democracy and press freedom.
Breached Company
