The biggest cyber attacks in Italy (2020–2026)

In brief: Italy is one of the most attacked countries in Europe. In the first half of 2026 alone, Italian organizations suffered 148 confirmed ransomware attacks, with manufacturing the most targeted sector, and the groups Qilin and LockBit each claiming more than 20 Italian victims. The attacks below are the ones that changed how Italian companies and public bodies think about security: a regional health system frozen for weeks, a lab network with 380 sites shut down, a cloud provider outage that took 1,300 municipalities offline. Most of them started with one employee and one email.

Timeline: the attacks that defined Italian cybersecurity

2020 – Enel, Campari and Luxottica: ransomware discovers Italian industry

In 2020, three of Italy’s best-known companies were hit within months. Energy giant Enel was attacked twice (Snake in June, Netwalker in October, with a reported €14 million ransom demand and 5 TB of data claimed stolen). Campari was hit by Ragnar Locker in November, with a $15 million demand and a disruption to its IT for weeks. Luxottica suffered an attack in September that halted production in Agordo and Sedico for days. The lesson Italian industry drew: ransomware had arrived, and it targeted the factories, not just the office.

2020 – Leonardo: the insider

Not every attack comes from outside. At defence group Leonardo, an IT employee installed malware on 94 workstations over two years and exfiltrated around 10 GB of data, including military project information, before being arrested in December 2020. It remains Italy’s most cited example of why access control and monitoring matter even with trusted staff.

2021 – Regione Lazio: a region’s healthcare frozen

On 1 August 2021, a ransomware attack on the IT systems of the Lazio region took down the COVID-19 vaccination booking portal and dozens of regional services for weeks. The entry point was reportedly the compromised laptop of an employee working from home, from which attackers reached the data centre. Rome’s vaccination campaign had to fall back to manual processes. It was the first time an Italian attack dominated national news for days, and it triggered the creation of the national cybersecurity agency ACN, established that same month.

2022 – Comune di Palermo, Trenitalia and the public sector wave

In June 2022, the Municipality of Palermo was hit by Vice Society: city services, from the registry to traffic cameras to online payments, were offline for weeks and the group published stolen documents. In March 2022, Ferrovie dello Stato / Trenitalia suffered a Hive ransomware attack that disrupted ticket sales. Local health authorities (ASL Napoli 3 Sud in January 2022, among others) saw patient systems encrypted. 2022 was the year Italian public bodies learned they were targets.

2023 – Ferrari, ACEA and the extortion-without-encryption trend

In March 2023, Ferrari disclosed that attackers had obtained customer contact data and demanded a ransom; the company refused to pay and informed customers directly. In February 2023, Rome’s utility ACEA was hit by Black Basta, disrupting internal systems (electricity and water supply were not affected). Both cases showed the shift to data theft and extortion, where attackers no longer need to encrypt anything to apply pressure.

December 2023 – Westpole: one supplier, 1,300 public bodies

The attack with the widest impact on Italian daily life did not hit a famous brand. On 8 December 2023, LockBit attacked cloud provider Westpole, which hosts services for PA Digitale, a supplier to around 1,300 municipalities, provinces and other public bodies. Payroll, accounting, protocol and registry systems were unavailable for weeks, in some cases into January. It is Italy’s clearest supply-chain lesson: your security is only as good as your supplier’s.

April 2024 – Synlab Italia: 380 labs shut down

On 18 April 2024, Synlab Italia, which runs 380 laboratories and medical centres performing more than 35 million analyses a year, shut down its entire Italian IT environment after a ransomware attack by Black Basta. Sampling points and labs suspended services. Synlab refused to pay; on 13 May the group published around 1.5 TB of data, including medical test results. One analysis of the attack chain points to an initial infection via a malicious email (QBot) weeks before the ransomware was deployed. The case is now the standard example in Italy of what one click in a healthcare organization can cost.

2024 – InfoCert and the data-broker scandal

In December 2024, digital identity provider InfoCert reported a breach at a third-party supplier exposing data of 5.5 million customers. Earlier in the autumn, the Equalize investigation revealed a private intelligence network that had illegally accessed government databases on tens of thousands of people, allegedly with help from insiders. Both cases made 2024 the year Italians started asking where their data actually sits.

2025–2026 – Qilin, LockBit 5.0 and the manufacturing wave

Ransomware against Italy did not slow down. Trackers counted 148 confirmed attacks in the first half of 2026, a jump from 16 attacks in July to 48 in August 2026, and manufacturing as the most hit sector, followed by healthcare and services. Named 2026 cases include a water utility (Alto Calore Servizi) and a Trieste hospital group claimed by extortion groups. Intel 471 describes the current pattern for Italy as initial-access brokers selling VPN and email access, followed by ransomware, with vishing (voice phishing) increasingly used to get employees to hand over credentials.

The biggest attacks at a glance

What the Italian cases have in common

• The entry point is a person or a supplier, not a zero-day. Lazio started on an employee laptop, Synlab reportedly with an email, Westpole and InfoCert through a supplier, Leonardo with an insider. Firewalls were not the weak point.
• Healthcare and public bodies pay the highest price. Not in ransom, but in weeks of downtime and in medical and personal data on leak sites.
• Not paying works, if you can afford the downtime. Synlab and Ferrari refused; both recovered. Both also had backups and a communication plan.
• Vishing is the new phishing. The 2026 reports single out voice calls to employees as the fastest-growing way into Italian companies, which is why training now has to cover the phone, not only the inbox.

What this means for Italian SMEs under NIS2

Italy transposed NIS2 early, through Legislative Decree 138/2024, in force since October 2024, with ACN as the supervising authority. Medium and large companies in 18 sectors (and smaller ones designated by ACN) must register, report incidents within 24 hours and 72 hours, and implement the minimum measures of Article 21, which explicitly include cybersecurity training for staff and for management. Every case above maps to one of those measures: supplier security (Westpole, InfoCert), access control (Leonardo, Lazio), training and phishing resilience (Synlab, the 2026 vishing wave). For a practical breakdown, see our NIS2 guide 2026 and what NIS2 means for directors.

Five lessons for any company, in Italy or elsewhere

1. Train the people who click. Continuous, short training beats a yearly module; the 2026 attacks start with emails and phone calls to ordinary employees. Guardey’s security awareness training is built for exactly that rhythm, in Italian too.
2. Test with simulations, including voice. Monthly phishing simulations show who would click before an attacker does.
3. Ask your suppliers the Westpole question. Who hosts your payroll, your registry, your identity provider, and what happens to you when they are down?
4. Enforce MFA on VPN and email. The access brokers selling into Italy in 2026 sell credentials; MFA makes most of them worthless.
5. Decide now whether you would pay. Synlab and Ferrari had decided before the attack. Backups, a recovery plan and a communication plan make “no” a realistic answer.

Frequently asked questions

What was the biggest cyber attack in Italy?

By impact on daily life, the December 2023 Westpole attack, which left around 1,300 public bodies without core systems for weeks. By data sensitivity, the 2024 Synlab Italia attack, which leaked 1.5 TB including medical results. By symbolic weight, the 2021 Lazio region attack that led to the creation of ACN.

How many cyber attacks does Italy suffer per year?

Trackers counted 148 confirmed ransomware attacks in the first half of 2026 alone; European reports place Italy fourth in Europe for ransomware victims, after Germany, the UK and France. Phishing and business email compromise are far more frequent but rarely reported publicly.

Which sectors are most targeted in Italy?

Manufacturing first (Italy’s industrial base is dense with mid-sized companies), then healthcare, public administration and professional services.

Does NIS2 apply to my company in Italy?

If you are a medium or large company (50+ employees or €10 million turnover) in one of the 18 NIS2 sectors, yes, and you should already be registered with ACN. Check our NIS2 guide for the sector list.