Italy

This page covers cyber threats to Italy. It brings together official Italian sources (the National Cybersecurity Agency ACN and the data protection authority, the Garante), a US government advisory, and Brandefense research. Where a source gives a number or a date, the page says who gave it.

Threat groups that official sources link to Italy

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

Lazarus Group: a joint advisory from CISA, the FBI and the US Treasury (AA21-048A, first published 17 February 2021) lists Italy among the countries where actors it calls HIDDEN COBRA targeted organizations with AppleJeus malware since January 2020. The advisory names the sectors as energy, finance, government, industry, technology and telecommunications, and says the agencies attribute Lazarus Group to North Korean state-sponsored actors.

LockBit: on 19 December 2023 ACN said that the Russian-speaking group Lockbit 3.0 carried out a ransomware attack on Westpole S.p.A. and PA Digitale S.p.A. About 1,000 public bodies are contractually linked to PA Digitale, and ACN said data was recovered for more than 700 of them. The attack took place on 8 December. In its March 2025 summary ACN also lists LockBit among the ransomware groups most active by number of claims, together with RansomHub.

Other groups appear in official Italian texts but have no profile here. ACN says the DDoS attacks of 28 December 2024 on airport and Foreign Ministry websites were claimed by NoName057(16) on its Telegram channel.

Incidents on record

The incidents listed below are major ones that official Italian bodies documented. Where sources disagree, the incident page says so. Small incidents are not listed.

How attackers target Italy: Brandefense research

Our own research mentions Italy in several posts. In summary, as our posts report:

State-linked activity: the Cicada report says the Chinese-supported group Cicada ran espionage campaigns against government agencies and non-governmental organizations in many countries, including Italy, using vulnerable Microsoft Exchange servers for initial access. The BellaCiao analysis notes that its attackers appear to sort victims by country code, including IT for Italy.

Banking trojans: the Xenomorph report says this Android banking trojan also targets users in Spain, Portugal, Italy and Belgium.

Ransomware: the AvosLocker research summary lists Italy among its targeted countries. The Medusa analysis says Medusa buys access from initial access brokers in only six countries, and Italy is one of them. Our Q3 2023 ransomware report says Brazil, Italy and Australia saw fewer attacks than in the previous quarter but were still targeted, and the Q2 2026 ransomware review lists Italy among the most frequently targeted countries in its LockBit section.

Data sales: a reported WhatsApp data sale listed 35 million user records of Italian citizens in the claimed database.

How Brandefense helps

The threats above are the kind that Italian organizations meet. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

ACN is Italy’s national cybersecurity authority. It was set up by Decree-Law 82 of 14 June 2021. The same decree makes it the Italian National Coordination Centre (NCC-IT) under EU Regulation 2021/887.

Italy transposed the NIS2 Directive (EU) 2022/2555 through Legislative Decree 138 of 4 September 2024. ACN says the decree confirms it as the competent national NIS authority and single point of contact. The scope grows to 18 sectors, 11 highly critical and seven critical. From 1 December 2024 entities in scope must register on the ACN platform, and penalties are aligned with those in the GDPR.

Law 90 of 28 June 2024 deals with strengthening national cybersecurity and with computer crimes. It was published in the Official Gazette on 2 July 2024. Bodies covered by Article 1(1) of the law must tell ACN who their cybersecurity referent is.

The National Cybersecurity Strategy 2022-2026 foresees 82 measures by 2026, under three objectives: protecting strategic national assets, responding to threats, incidents and crises, and the secure development of digital technologies. ACN defined the strategy and says it will also check that the objectives are reached.

How incident response is organized

CSIRT Italia is the response team inside ACN. ACN says it is part of the Cyber Operations and Crisis Management Service, which responds to cyber events of large impact and monitors threats. When a wave of DDoS attacks hit public sites in January 2025, ACN said it activated the CSIRT, which worked to restore sites and contain the effects.

ACN published a guide to notifying incidents to CSIRT Italia in July 2024. It brings together the instructions for entities in the National Cybersecurity Perimeter, for NIS and telecom entities, and for bodies covered by Law 90/2024. Reports are made through a form on the CSIRT Italia website. In the first half of 2026 CSIRT Italia received 1,160 notifications, of which 953 were mandatory and 207 voluntary.

Sectors and ransomware

ACN counted 2,171 cyber events in the first half of 2026, 47% more than a year earlier, and 1,072 incidents with confirmed impact. ACN says the rise comes mainly from wider NIS2 monitoring, not from a proportional rise in the threat. It reports 181 ransomware attacks (down 12%) and 407 DDoS incidents (down 32%). The sectors most affected by cyber events were manufacturing, technology and health. For ransomware they were manufacturing, retail and technology. ACN names reuse of previously compromised valid credentials as a main enabler of ransomware compromises.

For the first half of 2025 ACN counted 1,549 events and 346 incidents with confirmed impact, with DDoS attacks up 77% from 336 to 598. A pro-Russian campaign in June 2025 lasted 13 days and made 275 attacks on 124 targets. In a 2024 report ACN says Italy tends to rank fourth among European countries hit by ransomware, with 12% of cases in Europe. For February 2026, ACN says state-sponsored hacktivist groups targeted hotels in the Milan-Cortina Olympic areas, public administrations and transport operators.

Personal data

Italian personal data breaches fall under the GDPR, supervised by the Garante Privacy. In a decision on the 2021 Lazio attack, the Garante quotes Article 33: a controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours. In April 2024 the Garante fined LAZIOcrea, the Lazio Region and ASL Roma 3 for that attack. It fined ASL Roma 3 EUR 10,000 because, unlike other health bodies, it did not notify the breach.

ACN publishes attack counts in its Operational Summaries, quoted above. Further figures for Italy will come from Brandefense Atlas.