How a secret service raid exposed an alleged spy plot inside the Hungarian opposition

Behind Vladimir Zelensky’s public feud with Viktor Orban, the arrest of two suspected spies in Budapest adds to claims that the Ukrainian leader is waging a shadow campaign to take out the Hungarian prime minister.

Read more

On July 8, 2025, agents of Hungary’s National Bureau of Investigation (NNI) and National Security Service (NBSZ) raided two properties: a suburban home in a small town near Budapest, and a houseboat, packed with servers, hard drives, phones and covert recording equipment, moored on the city’s Danube waterfront.

The men targeted in the raids – a 19-year-old in the suburbs and a 38-year-old British/Hungarian dual citizen in Budapest – were IT specialists working for opposition leader Peter Magyar’s Tisza party. Between both locations, the raids yielded enough hard drives, USB drives, and computers that backing up all the data took over a month.

The operation didn’t make any headlines until this week, when two separate versions of events began to emerge.

Did Orban target his opponents?

According to a report by the pro-opposition outlet Direkt36, the government agents claimed that they were searching for child pornography, but came up empty handed. Instead, they seized files suggesting that both men were in contact with an unidentified handler codenamed ‘Henry’, who was instructing them to steal documents from Tisza’s servers and conduct cyberattacks against the party.

In this version of events, the NBSZ and Constitutional Protection Office (AH) steered the NIN’s investigation away from ‘Henry’, holding only in-person briefings on the matter and “persuad[ing] police leadership not to pursue the investigation in this direction.”

To the reporters at Direkt36, one of whom is currently being investigated for possible espionage, this intervention strongly hinted that the child pornography warrants were a ruse, and ‘Henry’ was a creation of the Hungarian secret services, who were running a “covert operation to bring down the [Tisza] party.”

This is the end. A world built on lies has shattered.
Hungarian intelligence services, acting on the orders of @PM_ViktorOrban and his inner circle, have worked against the TISZA party, which is preparing for a change of government. This affair, the "Orbán-gate", recalls the…

— Magyar Péter (Ne féljetek) (@magyarpeterMP) March 24, 2026

The report does not explain why the secret services would raid their own operatives. Nevertheless, Magyar himself declared that the story “recalls the darkest days of communism and is even more serious than the Watergate scandal.” The supposed plot against Tisza “crosses every line” and “amounts to an attempted coup against Hungary,” he added.

Or was Tisza’s IT team working with Ukraine?

In an intelligence briefing declassified on Tuesday, Hungary’s National Security Committee filled in the details that Direkt36 allegedly left out. The 19-year-old suspect had been under surveillance since 2022, two years before the emergence of Tisza, the briefing states.

The suspect, identified as ‘HD’, allegedly made contact with an Estonian citizen in 2022, who sent him to Kiev the following year to train with the IT Army of Ukraine, a cyberwarfare group run by the Ukrainian government. HD is alleged to have carried out “several operations in the interests of Ukraine,” visited the Ukrainian embassy in Budapest on multiple occasions, and in May 2025, two months before the raid, also visited the embassy of an EU member state in to obtain “secret service tools.” The teenager was questioned twice by counterintelligence officers over these activities.

The suspect who lived on the boat was well known to Hungarian authorities, the report stated, and had a record of misuse of IT systems, computer fraud, and extortion. Identified as ‘MT’, he came under surveillance when he began working alongside HD for Tisza. The 38-year-old had allegedly been interested in purchasing intelligence tools since 2019, and once in contact with his teenage colleague, “participated in negotiations aimed at purchasing intelligence equipment that requires a license (spyware, signal jamming, devices suitable for disguised image and sound recording).”

The two men contacted a “well-known spyware manufacturer and distributor” in February 2025, aiming to purchase the software, the report states. HD, it claimed, has admitted to counterintelligence agents that “he was assisted in this by the secret service of a European Union country.”

Hungarian authorities launched the raids having received an anonymous tip claiming that the suspects planned to use some of these tools to covertly record child pornography. While the accusations have not been substantiated, they are now being investigated for possessing or manufacturing “military equipment requiring a license.”

In this version, it is unclear whether ‘Henry’ was one of HD’s foreign contacts, or whether he was an undercover Hungarian agent building a case against the two suspects.

Source: RT - Daily news