February 10, 2025
Italian furniture company Alf DaFrè was hit by a ransomware attack. The hackers encrypted company data and disabled computers and machinery, affecting the production chain. An estimated 15 per cent of the company’s IT infrastructure was compromised. The company decided not to pay the ransom. It shut down the entire IT system to avoid further damage.
Production was shut down and employees were laid off for 8 days.
January 19, 2025
A 15-year-old logged into a portal that controls the routes of oil tankers and transport ships in the Mediterranean Sea, changing some routes. The teenager was referred to youth justice in Italy.
April 2, 2025
On April 2, 2025, Mobilità di Marca (Mom) suffered a cyberattack disrupting their electronic ticketing services for two days. The attack targeted servers integral to the Telemaco platform used by Mom and other public transport companies. The timing of the attack suggests a strategic attempt to maximize disruption.
April 28, 2025
On April 28, 2025, KLINGER Italy was reported to have experienced a data breach. The size of the data leak is currently unknown. The threat actor associated with this breach is identified as Gunra.
March 24, 2025
AMA, the municipal waste management company of Rome suffered a cyberattack on its IT systems. The company took immediate action to deal with the attack and is collaborating with the National Cyber ​​Security Agency. Reportedly operating systems are working, while the online ones are being restored.
March 29, 2025
Public transport company BusitaliaIa disclosed data breach on its website: “Busitalia has been the victim of a cyber attack. The attack was detected at an external data center between March 29 and March 30, 2025. It compromised personal data of registered passengers.
The incident particularly concerns digital channels such as the Busitalia Veneto App and the subscription portal. Both are used daily by thousands of users to manage travel and tickets.
April 5, 2025
Mooney Servizi/My Cicero was hit by a cyber attack on April 5. The company manages the digital systems of mobility companies in the main Italian cities. Personal data of users of Atm, Tuabruzzo and Unico Campania apps were compromised. The attack caused slowdowns and malfunctions. The compromised data included users’ names, contact information, and customer profile.
ATM requested a detailed report from Mooney Servizi, reinforced its security protocols for third-party access, and notified both the Italian Data Protection Authority and the National Cyber Security Agency.
January 26, 2025
Marposs, a company specializing in precision measurement equipment, was hit by a Cryptolocker cyberattack. The impact of the cyberattack has been significant, particularly in the logistics sector. The production processes were less severely affected.
Marposs has implemented a solution to limit the consequences of the attack. The activation of emergency situation tool, “Cassa Integrazione Ordinaria” (Redundancy Fund) has been requested until February 7. This is a redundancy fund which helps companies to maintain the labour force in times of economic difficulties. It is unknown at this time how long it will take to decrypt the data stored in the company systems and restart the company’s activities.
March 23, 2022
Italian State Railways (FS) and its subsidiaries Trenitalia and Italian Rail Network (RFI) suffered a major ransomware attack on March 23 . The attack severely impacted ticketing systems, passenger information displays, and internal communications.
FS implemented emergency measures, allowing passengers to purchase tickets on trains without penalties. The primary focus was on restoring critical systems and minimizing further disruption to passenger services. Freight transport by rail was temporarily suspended for 24 hours. Reportedly affecting FS, Metrans Rail of Czech Republic, HUPAC of Switzerland and Lineas of Belgium.
Metrans Rail of Czech Republic shutdown their Italian operations for 24 hours the following day. They stated it was temporarily not possible to cross the border at Austria and Slovenia. Marc Jansen, director of operations at carrier Hupac, said trains have been standing still for 24 hours. Arno van Deursen, Country Manager Lineas NL said “Our trains to and from Italy have been standing still for about 15 hours”.
Elements were found on the computer network of Trenitalia and RFI that could be linked to a cryptolocker infection. Italian authorities, including the Postal Police’s National Cybercrime Center (Cnaipic) and the National Cybersecurity Agency (Acn), launched a joint investigation.
December 28, 2024
The websites of Milan’s Linate and Malpensa airports were hit by a cyberattack on Saturday morning, Corriere della Sera reported.
The hack caused no disruption to operations, the Italian newspaper said, with the main impact felt by travelers attempting to check the status of their flights.
Italy’s Foreign Ministry website and a number of other sites were also taken down at least temporarily.
The pro-Russian group NoName claimed responsibility for the action via a message on Telegram, according to the newspaper. Italy’s Postal Police’s cybercrime unit is working on the case to support affected targets and help with an investigation.