IT systems increasingly vulnerable. From false air travel alerts and sabotage of the cold chain to the publication of sensitive data on politicians and investigators by cybercriminals on the dark web. This hybrid war waged through cyber-attacks – likely orchestrated by pro-Russian activists – aims to sow chaos in countries that have expressed support for Ukraine. It is a threat to democracies, with Italia among the nations affected. Defence Minister Guido Crosetto has described it as a new ‘epoch-defining challenge’.
In Italia, cyber responsibilities are fragmented across the various administrations
The national security apparatus is mobilising at the highest levels to tackle the wave of cyber-attacks that has been affecting Italia for weeks. On Tuesday 10 November, the Minister of the Interior, Matteo Piantedosi, convened the National Committee for Public Order and Security to focus on the cyber-attacks that have targeted infrastructure and other areas.
But how is Italia organised to detect and counter threats? Responsibility for cyber security remains fragmented across the various government departments. In 2021, efforts were made to establish a coordination framework through the National Cybersecurity Agency, which is tasked with safeguarding security and resilience in cyberspace, in order to prevent and mitigate as many cyber-attacks as possible. There is also the Postal Police, which protects critical national IT infrastructure and combats crimes committed using computer systems. The Intelligence Agencies have their own cyber units, as do the Ministry of Defence and other ministries.
The Farnesina case
With the reform of the Ministry of Foreign Affairs and International Cooperation – strongly championed by Minister Tajani and which came into force on 1 January 2026 – a Directorate-General dedicated to cyber issues, IT and technological innovation, as well as a 24-hour cyber operations centre. It is explained that when the cyber operations centre detects an attack, it immediately liaises with the National Cybersecurity Agency (ACN), CSIRT Italia and the National Centre for Combating Cybercrime and Protecting Critical Infrastructure (CNAIPIC) of the Postal Police, to implement a coordinated response to the attack across the entire national IT system. Immediately after the incident is detected, ministry sources report, coordination is initiated with the EU’s cyber security bodies.
The Cyber Centre’s activities are organised around three main areas: threat and risk prevention; monitoring; and response to attacks. Since it began operations in January 2026, it has intercepted and blocked over 630,000 malicious events and attempts directed at the administration’s digital perimeter; neutralised approximately 3.5 million malicious emails, out of a total of nearly 23 million emails received from external domains; and carried out thousands of analytical tasks, 817 of which took place in the last quarter. Among the main attacks repelled, according to sources at the Ministry of Foreign Affairs, ‘were those during Ukrainian President Zelensky’s visits to Italia, in particular in May 2023 and then in January 2025, and during the Milan-Cortina Winter Olympics, in February 2026, when, in addition to services linked to the Olympic event, the websites of Italian diplomatic missions were also targeted’. Most recently, a ‘particularly severe cyber-attack on the Ministry’s website was recorded in October this year’. In the attack, “which was repelled without any damage to the systems, a number of embassy and consulate websites around the world were also targeted”. “DDoS – Distributed Denial of Service” attacks, however, occur on a daily basis.