World Leaks dumps 8.5 TB stolen from pro-government Hungarian publisher Mediaworks

On 1 May 2026, Mediaworks Hungary Zrt., a Hungarian media company widely regarded as part of the pro-government media ecosystem aligned with Prime Minister Viktor Orbán, issued an extraordinary statement saying it had suffered a serious cyberattack in which unauthorized people illegally obtained a significant amount of data. The company later said the attack took place on 30 April 2026.

The leak

The data-extortion group World Leaks, which emerged in early 2025 as a rebrand of the Hunters International ransomware operation, claimed the attack and published about 8.5 terabytes on its dark-web site. Mediaworks said the attackers had taken nearly 15 million files. Local outlets reported that the material included payroll records, contracts, financial statements and internal communications, along with documents containing names, addresses and bank account details. Some independent Hungarian media reported on alleged editorial notes in the leak, including references to contact with Moscow about coverage of Ukraine's president; the authenticity of that material has not been verified.

It was the first known World Leaks operation against a Hungarian organization.

Legal and regulatory response

Mediaworks warned that using, processing or publicizing the stolen data was illegal and said it would take legal action against anyone doing so. On 6 May, Hungary's National Authority for Data Protection and Freedom of Information (NAIH) opened an investigation and warned media organizations against publishing links or information that would enable access to the leaked material, stressing that GDPR obligations still apply after data has been exposed.

Why it matters

The breach combines a large-scale personal data exposure with political sensitivity: a hack-and-leak against a government-aligned media group, followed by a debate over how far journalists may report on stolen documents.