World Leaks Ransomware Group Claims Breach of Pro-Orbán Hungarian Media Firm
The ransomware group World Leaks has published 8.5 terabytes of data stolen from Mediaworks, a major Hungarian media firm, following a breach that exposed sensitive internal communications and financial records.
The ransomware group known as World Leaks has claimed responsibility for a significant data breach at Mediaworks, a prominent Hungarian media conglomerate. The group announced that it successfully exfiltrated and subsequently published nearly 8.5 terabytes of sensitive data on its dark web portal last week The Record. The leaked information reportedly contains a wide array of internal documents, including payroll records, legal contracts, financial statements, and private internal communications The Record.
Mediaworks, which manages a vast network of newspapers, magazines, and digital outlets, confirmed the security incident on Friday. The company acknowledged that a substantial volume of data was accessed by unauthorized parties and stated that an internal investigation is currently underway The Record. In response to the leak, Mediaworks issued a stern warning to journalists and media organizations, asserting that the possession, processing, or disclosure of the stolen data constitutes a criminal offense under local law The Record.
The breach has sparked political controversy due to the nature of the leaked files. Independent news outlets that reviewed the data reported the discovery of internal notes from a January 2025 editorial meeting. These documents allegedly suggest that Mediaworks staff discussed contacting Moscow for assistance in producing content intended to discredit Ukrainian President Volodymyr Zelensky The Record. Mediaworks has reportedly threatened legal action against outlets like Media1 that have reported on these findings, though the publication has refused to comply, citing the public interest of the information The Record.
World Leaks, the entity behind the attack, is a relatively new player in the cyber-extortion landscape, having emerged in early 2025 as a rebrand of the Hunters International ransomware operation The Record. Unlike traditional ransomware gangs that prioritize the encryption of victim systems to force payment, World Leaks focuses primarily on data theft and extortion, leveraging the threat of public exposure to pressure its targets The Record. While the group has previously targeted organizations in the United States, Europe, India, and Canada, this incident marks its first identified operation within Hungary The Record.
This attack is not the first time Mediaworks has faced digital disruption. In 2022, the hacktivist collective Anonymous defaced several of the company's websites, citing objections to the firm’s perceived role in disseminating pro-Kremlin propaganda aligned with Prime Minister Viktor Orbán’s policies The Record. As the company navigates the fallout of this latest breach, the incident highlights the ongoing intersection of cyber-extortion, political influence, and the protection of sensitive corporate data in an increasingly polarized media environment.