Italy has been grappling with a multi-pronged cyber offensive, with hackers leaking the personal data of Foreign Minister Antonio Tajani and allegedly breaching the country’s Anti-Mafia Investigative Directorate (DIA) to ransom sensitive law enforcement intelligence for cryptocurrency.
The digital assaults have triggered alarm within the Rome Prosecutor’s Office, which is currently managing a large volume of cyber attacks against public institutions and private enterprises.
According to an exclusive report by Il Giornale today, investigators from the Postal Police and the National Anti-Cybercrime Centre for the Protection of Critical Infrastructure (CNAIPIC) are attempting to determine whether a hidden, central coordination is directing the offensive or if the strikes are independent.
Some cases are considered so serious that they are being kept under strict confidentiality, while a specific investigative file concerning targeted Rome chief prosecutor Francesco Lo Voi is to be transferred to prosecutors in Perugia, central Italy, for jurisdictional reasons.
Rome prosecutors have opened a case into the publication on the dark web of personal data belonging to Tajani, Lo Voi and Postal Police chief Ivano Gabrielli, according to news agency LaPresse. Possible offences under investigation include unauthorised access to computer systems and threats.
The concern was compounded today by revelations that the DIA is verifying a possible system compromise.
On the dark web, an actor operating under the pseudonym “weykofa” has listed a 220-megabyte archive allegedly stolen from the anti-mafia agency’s databases.
The hacker is demanding a ransom paid in Bitcoin in exchange for roughly 300 files that reportedly contain intelligence on more than 20 organised crime syndicates, personnel data, financial documents and correspondence with both Europol and the European Union.
The listing, posted on November 8, was relayed on X by the monitoring account Dark Web Informer, which described the claim as unverified.
Sources close to the case later told Il Messaggero that checks so far suggested only the DIA’s public website had been copied and that no protected data had been exfiltrated.
These incidents coincide with a targeted harassment campaign against senior government officials.
Tajani, who also serves as Italy’s deputy prime minister, confirmed on social media on November 7 that hackers had been sharing his confidential information for several days.
He noted that the perpetrators were actively seeking additional details about him and his family, even offering financial compensation to individuals willing to provide further sensitive material.
Italian media have attributed the campaign to the pro-Russian hacker group NoName057(16).
According to the foreign minister, the attack was politically motivated, stating that defending the freedom and independence of a sovereign nation had made him a target for criminal organisations.
Tajani said he would not be intimidated and would keep defending his ministry, Italy and its allies.
“Our position on Ukraine is the political reason I have been targeted: defending the freedom of a sovereign state, taking a clear stand in support of a nation’s democracy and independence, is dangerous for these criminal entities.”
Despite the ongoing threats, Tajani remained defiant.
On November 8, he posted a picture of him with his new dog on X, stating: “I want to give the pro-Russian hackers who spy on my life a piece of information. From today, there’s a new guardian in the Tajani household: dear Argo, welcome to the family!”
Voglio dare io un’informazione agli hacker filo russi che spiano la mia vita. Da oggi in casa Tajani c’è un nuovo guardiano: caro Argo, benvenuto in famiglia! pic.twitter.com/NzKowwPIa4
— Antonio Tajani (@Antonio_Tajani) November 8, 2026
The leaked material was discovered on the Tor network during routine monitoring by Italian cybersecurity authorities, a person close to the minister told Reuters.
Screenshots reviewed by Reuters revealed that Tajani’s photograph was included on a list of 18 individuals branded as “citizens hostile to the Russian Federation”, a register that also included cybersecurity experts.
Tajani indicated that the breaches were additionally a retaliatory response to the Foreign Ministry’s recent efforts to reinforce its digital security infrastructure.
Italy’s data protection authority, the Garante per la protezione dei dati personali, has warned that spreading the leaked information is prohibited and said it would carry out checks.
Italian Prime Minister Giorgia Meloni, who has positioned Rome as one of Ukraine’s strongest European allies, issued a statement of solidarity with Tajani.
She condemned the trafficking of confidential data belonging to public officials, calling the incident a matter of grave concern that requires the utmost determination to address.
Tajani has asked for the issue to be discussed at the G7 foreign ministers’ meeting in Paris on November 9-10.
The Italian crises highlight a broader, escalating pattern of borderless cyber warfare allegedly entangled with the geopolitical fallout of the war in Ukraine. Data weaponisation is increasingly being deployed by both pro-Kremlin and anti-Russian proxy actors, according to Western capitals.
The Kremlin has not issued an official comment regarding the incident, though Moscow has consistently denied any involvement in foreign cyber attacks or state-sponsored hacking operations.
In a parallel digital offensive, anti-Kremlin Belarusian hackers known as Cyber Partisans and a pro-Ukrainian group dubbed Silent Crow claimed on November 1 to have executed a massive breach of Rosstat, Russia’s state statistics agency.
The hacker collectives assert they extracted more than 10 terabytes of data, including mortality statistics they say would reveal Russia’s true military losses in Ukraine. Silent Crow has put the haul at about 23 terabytes.
Rosstat has acknowledged that its systems were hit by targeted cyber attacks between October 29 and November 1 but has denied that any data were leaked. The incident underscores how digital infrastructure across Europe has become a primary theatre for intelligence gathering, extortion and psychological warfare.
French President Emmanuel Macron has warned that Russia could stage an attack in France like the failed drone strike on Leipzig/Halle airport in August, though Moscow’s responsibility for the German incident has yet to be proven. https://t.co/KTewdjWgDZ
— Brussels Signal (@brusselssignal) September 25, 2026
