Orban-Gate: How Hungary's Secret Services Tried to Hack the Opposition

Police documents obtained by Direkt36 reveal that Hungary's domestic intelligence agency directed raids against Tisza Party IT workers using a fabricated child abuse tip - three weeks before the April 12 election that could end Viktor Orban's 16-year grip on power.

Budapest. Hungary's parliamentary election is scheduled for April 12, 2026 - and according to Direkt36's investigation, someone in Orban's government couldn't afford to lose it fairly. (Pexels)

On the morning of July 8, 2025, three officers from Hungary's National Bureau of Investigation knocked on the door of a family home in a small town near Budapest. They were looking for a 19-year-old. The charge: possession of child sexual abuse material.

At the same time, a second team raided a boat moored on the Budapest waterfront. Their target: a 38-year-old man who ran an IT security operation from an office built inside the vessel. Police seized 38 data storage devices - servers, hard drives, phones, USB sticks, laptops, desktop computers. They also found, tucked into the man's clothing, a leather belt with a tiny hidden camera in one of its holes.

No child pornography was found. On either device. On any of the seized machines.

What investigators did find, buried in text messages and recovered files, was something far more explosive: evidence of a systematic attempt to recruit informants inside Hungary's largest opposition party and gain unauthorized access to its internal IT infrastructure - ahead of the election that polls suggest could finally topple Viktor Orban.

The explosive findings, published on March 24, 2026 by Hungarian investigative outlet Direkt36, have sent shockwaves through Budapest and Brussels. Opposition leader Peter Magyar branded the operation "Orban-Gate," comparing it explicitly to Watergate. The government has not responded to any detailed questions.

The plot targeted the Tisza Party's IT infrastructure - its internal systems, servers, and digital communications. (Pexels)

The Anatomy of a False Flag

The operation began on July 1, 2025, with an anonymous tip submitted to the National Media and Infocommunications Authority. The tip accused the 19-year-old volunteer - an IT specialist who had helped Tisza Party with technical work - and the 38-year-old IT security lead of planning to produce and distribute child pornography. The tip alleged they intended to use a "hidden camera" to film children.

This framing is significant. Child pornography accusations are a classic vector for state harassment of dissidents and political enemies - they generate immediate social stigma, allow for sweeping device seizures under emergency provisions, and require minimal initial evidence. The accused have little recourse while the investigation proceeds.

What made this case immediately unusual was the involvement of Hungary's domestic intelligence service, the Office for the Protection of the Constitution (known by its Hungarian acronym AH). The AH's primary mandate is counterintelligence - detecting foreign spies, protecting the state from subversion. Child pornography is emphatically not in its remit.

According to Direkt36's sources, the AH did not merely offer assistance. It drove the operation from the beginning. Before the tip had even been formally processed by the NNI's cybercrime division - the unit that normally handles such cases - the AH had already called police leaders to insist the case be treated as a priority. An AH representative also insisted that a technical expert from the National Security Service (NBSZ) be present during the boat-office raid.

Both agencies - the AH and the NBSZ - operate under the supervision of the Prime Minister's Office, led by Antal Rogan, Orban's closest and most powerful aide.

Timeline of the covert operation targeting the Tisza Party's IT infrastructure, from the anonymous tip to the Direkt36 expose.

Who Was Henry?

The most disturbing element of the investigation is a figure known only as "Henry."

Henry made contact with the 19-year-old volunteer IT specialist and attempted to recruit him as an agent inside the Tisza Party. The messages found on seized devices outline Henry's demands clearly: report on the party's internal affairs, identify vulnerabilities in its IT systems, and eventually provide backdoor access to Tisza's digital infrastructure. In exchange, Henry promised generous payment and offered to bring the young man to a "secret base" to meet his "team."

Henry was not just fishing in the dark. He demonstrated knowledge of Tisza's internal operations that could only have come from existing surveillance - or from someone already embedded inside the party. Most chillingly, he told the 19-year-old that a stolen database of Tisza activists would be published online - one day before it actually happened.

The Tisza Party's activist database had been exfiltrated from its Discord server and subsequently leaked. Henry predicted this 24 hours before it became public. Either he was behind the leak, or he had prior intelligence about it. Neither option is reassuring.

The young IT worker played along with Henry while secretly documenting everything and sharing the messages with the 38-year-old security lead on the boat. Together, they planned to expose Henry using the hidden-camera belt. That plan was destroyed when police raided both their addresses simultaneously, eight days after Henry had first made contact.

Direkt36 reports that the NNI - despite finding no child abuse material and finding clear evidence of what appeared to be a covert political conspiracy - did not investigate who Henry was or what organization he represented. Instead, according to sources familiar with the case, AH intervened to redirect the investigation away from the recruitment plot and toward the camera belt. Both men were eventually charged with the misuse of "military equipment" - a charge related to the belt camera.

In other words: the victims became the suspects. The spy became invisible.

Hungary has a documented history of deploying state surveillance tools against journalists, lawyers, and opposition figures. (Pexels)

Sixteen Years of Captured Institutions

To understand Orban-Gate, you have to understand what the Hungarian state has become after 16 years of Fidesz rule.

When Viktor Orban returned to power in 2010 with a two-thirds parliamentary supermajority, he began a methodical reconstruction of Hungary's institutional architecture. Courts were packed with loyalists. The independent electoral commission was replaced. Constitutional amendments were passed that entrenched Fidesz's advantages in the system. State media became a propaganda apparatus. Private media was systematically bought up by Orban-aligned oligarchs and consolidated into a single media trust that ceased to function as independent press.

The intelligence services were folded firmly under the Prime Minister's Office - specifically under Antal Rogan, a former construction businessman who became Orban's intelligence and propaganda czar. The AH, the NBSZ, and related agencies answer to Rogan. They are not independent. They do not report to parliament in any meaningful way.

This matters because in functioning democracies, intelligence services operate under oversight mechanisms precisely to prevent their use against domestic political opponents. In Hungary, those mechanisms have been systematically dismantled.

This is not the first time Orban's government has been linked to surveillance of political opponents. In 2021, the Pegasus Project - a consortium of investigative journalists coordinated by Forbidden Stories and Amnesty International - revealed that Hungary was among the governments that had deployed NSO Group's Pegasus spyware against its own citizens. The targets included Hungarian journalists, lawyers, and people connected to opposition figures. Hungary became the only European Union member state confirmed to have used Pegasus against its own civil society.

The Orban government admitted purchasing the software but denied using it improperly. No accountability followed.

The key figures in Hungary's escalating election spy scandal, from the intelligence chiefs to the whistleblowers.

Peter Magyar: The Man Orban Most Fears

The reason the spy operation exists at all is Peter Magyar.

Magyar is not a lifelong opposition politician. He was an insider - a lawyer who married into Orban's political circle, whose ex-wife Judit Varga served as justice minister and briefly as parliamentary speaker. He benefited from proximity to power. And then, in early 2024, he broke publicly with the system he had inhabited, releasing audio recordings that implicated figures in Orban's inner circle in covering up a pedophilia scandal involving a convicted offender given a presidential pardon.

The scandal destroyed Katalin Novak's presidency. It also launched Magyar into a political career he had not planned. He founded the Tisza Party - named after one of Hungary's great rivers - and within months had built it into the most credible electoral challenge Fidesz had faced since returning to power.

By early 2026, polls were showing Tisza ahead of Fidesz. The precise margins varied by pollster, but the trend was consistent: for the first time in over a decade, there was a realistic scenario in which Viktor Orban lost a Hungarian election.

For Orban, this was not merely a political setback. Losing power means losing immunity. Magyar and other opposition voices have made clear they intend to investigate the corruption, cronyism, and institutional manipulation of the Orban years if they take office. Numerous Fidesz-linked oligarchs who have grown wealthy on state contracts would face scrutiny. The machinery of captured institutions would come under review.

The stakes, in other words, are existential - not just for Orban's political future but for the financial interests of an entire ecosystem that has organized itself around his continued rule.

"The Hungarian secret services, on the orders of Viktor Orban and his family, targeted Tisza as it was preparing for a change of government. This case - which I am calling Orban-Gate - is reminiscent of the worst abuses of the communist era and is more serious than the Watergate scandal that brought down President Nixon." - Peter Magyar, Tisza Party leader, March 24, 2026

Hungary's political contest has been marked by growing street protests, violence against activists, and now allegations of state-sponsored espionage. (Pexels)

The Government's Response: Silence and Counter-Narrative

The Orban government's response to the Direkt36 investigation has been a two-track operation.

Track one: institutional silence. The NNI, the AH, the NBSZ, the Prime Minister's Office, and the Interior Ministry all declined to answer Direkt36's detailed questions submitted before publication. The government has maintained this silence since the story broke. No official has held a press conference to address the specific allegations. No minister has given an interview accepting or rejecting the core claim - that state intelligence agencies directed a politically motivated raid against the opposition using a fabricated child abuse complaint.

Track two: the counter-narrative. Through Zoltan Kovacs, the government's international spokesman, the Orban apparatus released what it described as declassified elements of a national security briefing. The briefing claimed that figures connected to the Tisza Party have links to "Ukrainian actors" and "underground hacker networks." Pro-government media outlets - which represent the overwhelming majority of Hungarian broadcast and print media after years of consolidation - have amplified this framing, portraying the entire affair not as state espionage against an opposition party but as a foreign-sponsored operation to destabilize Hungary.

This playbook is familiar. When the Pegasus scandal broke in 2021, the government initially denied, then acknowledged the software's purchase, then pivoted to national security framing. When critics of Orban's relationship with Russia have surfaced, the government has accused them of serving Western intelligence interests. Any allegation of wrongdoing by the state becomes, in this narrative, evidence of foreign interference.

Political scientist Gabor Torok was direct in his assessment, writing publicly that the alleged operation crossed a clear line:

"To interfere in the life of an opposition party using state-owned, secret service tools, to organize IT specialists, and then use state organs to blackmail them, is not a part of normal political life." - Gabor Torok, Hungarian political scientist, March 2026

The case has gone viral in Hungary. A video posted by whistleblower Bence Szabo - the 38-year-old IT security lead from the boat - accumulated millions of views across platforms. Writer Gyorgy Dragoman captured the public mood on social media: "It's hard not to think that we live in the darkest political noir-spy-novel-technothriller reality."

With Tisza leading in polls ahead of the April 12 vote, the stakes for Orban's government could not be higher.

What the Documents Actually Show

The strength of the Direkt36 investigation lies in its documentary foundation. This is not a story built on anonymous tips or opposition allegations. It is built on police investigation records - specifically, the NNI cybercrime division's own case files, which Direkt36 obtained and reviewed.

Those files show:

• The anonymous tip was used as a pretext. The tip alleged child abuse material. No such material was found on any of the 38-plus devices seized across two simultaneous raids.
• The AH intervened before the investigation formally began. The intelligence service called police leadership to insist the case be prioritized - before the tip had even been properly processed. This is highly irregular for a child pornography investigation.
• The NBSZ sent a technical expert to the boat raid. The NBSZ is a signals intelligence and technical support agency for intelligence operations. Its presence at a child pornography raid is, according to NNI officers familiar with such cases, deeply unusual.
• The "Henry" recruitment was documented. Text messages on seized devices show the recruitment attempt in detail - the demands for access to Tisza's IT systems, the promised payment, the mysterious foreknowledge of the leaked activist database.
• The investigation was redirected away from Henry. Despite finding evidence of what appeared to be a covert political operation, NNI leadership - following AH intervention - focused the investigation on the camera belt rather than the identity or organization of the unknown recruiter.

Multiple sources familiar with Tisza's internal operations independently confirmed to Direkt36 that the two men under investigation did work for the party in the described capacities, and that the events described in the documents occurred as reported.

The Tisza Party itself declined to answer specific questions, citing the ongoing investigation and stating that any full accountability would need to wait until after the election - and, implicitly, until they had access to government files that would allow a complete picture to emerge.

Hungary's intelligence structure has been consolidated under Orban's Prime Minister's Office, removing the parliamentary oversight that constrains most European security services. (Pexels)

The EU's Dilemma - and Its Complicity

Hungary is a member of the European Union. It is bound by the EU's founding treaties, which commit member states to democracy, rule of law, and fundamental rights. And yet for over a decade, the EU has struggled to find a coherent response to Hungary's democratic backsliding.

Article 7 proceedings - the EU's mechanism for sanctioning member states that violate core values - were triggered against Hungary in 2018. Eight years later, those proceedings remain unresolved. The threshold for meaningful sanctions requires unanimity among member states, and Hungary has always been able to count on Poland and other sympathetic governments to prevent a consensus from forming.

The EU has deployed other tools - freezing cohesion funds, attaching rule-of-law conditionality to structural payments - but these measures have produced limited behavioral change from Budapest. Orban has proved adept at offering token concessions to unlock frozen funds while continuing the underlying practices that triggered the freezes.

The Orban-Gate affair forces the question that EU officials have long avoided: at what point does evidence of state intelligence services targeting opposition politicians ahead of an election cross the threshold from "rule of law concern" to electoral interference requiring direct EU intervention?

The answer, so far, appears to be: not yet. EU officials have expressed "concern." The European Parliament has passed resolutions. The fundamental architecture of Hungarian illiberalism remains intact.

This matters beyond Hungary's borders. What is being tested in Budapest in April 2026 is whether democratic backsliding within the EU has a floor - a point at which the bloc will act decisively to protect the integrity of elections in its own member states. The evidence from the last decade suggests no such floor has been established.

European Parliament member Thijs Reuten, a Dutch MEP who has been vocal on Hungarian press freedom, drew a direct parallel to the alumina sanctions loophole he had criticized separately: the EU, he argued, consistently enables behavior it claims to oppose by failing to close the institutional gaps that make it possible.

The EU has been unable to mount a decisive response to Hungary's democratic backsliding - a failure that has emboldened the Orban government across 16 years. (Pexels)

Three Weeks to April 12

Hungary votes on April 12. Three weeks from the publication of the Direkt36 investigation. The country is running an election in which one of the two main parties appears to have used state intelligence resources to infiltrate and sabotage the other.

The political fallout has been immediate and significant. The scandal has dominated public discourse. Pro-government media has tried to control the narrative with its counter-narrative about Ukrainian hackers and foreign interference, but the core facts documented in the NNI's own files are difficult to rebut. You cannot fact-check a police raid record out of existence.

Magyar has promised that a Tisza government would launch independent investigations into the intelligence services' activities. He has named the people he believes will face accountability. He has drawn the explicit Watergate comparison - and Watergate, it is worth remembering, began not with the break-in being discovered but with the cover-up unraveling in the months after Nixon won re-election by a landslide. The cover-up, not the crime, destroyed him.

The Orban government's calculation appears to be that it can weather the immediate scandal, win the election through a combination of institutional advantages - gerrymandering, state media saturation, control of election administration - and then either bury the story or punish those who surfaced it.

That calculation may be correct. Hungary's electoral system has been engineered over 16 years to favor Fidesz. Even when public opinion has shifted, the structural advantages built into the system have often produced outsized Fidesz parliamentary majorities. Magyar's Tisza Party will need not merely a plurality but a substantial margin to overcome those structural disadvantages.

What the Direkt36 investigation has done is ensure that whatever happens on April 12, it cannot happen in the dark. The mechanics of the operation are now public record. The question - who authorized it, who was Henry, which organizations orchestrated the recruitment plot - will not go away regardless of who wins.

"Under a Tisza government, both the political figures who commissioned these actions and the heads of the secret services will be held to account before the Hungarian judiciary." - Peter Magyar, Tisza Party leader, March 24, 2026

History has a way of validating patience. The leaked Watergate tapes were recorded in 1972. Nixon resigned in 1974. The documents exist. The evidence is in the record. The cover-up has a shelf life.

In Budapest, three weeks from an election that could determine whether 16 years of captured institutions finally face a reckoning, the clock is running.