Threat Intelligence · Incident Response
Italy’s Foreign Ministry defends against cyberattack, checks embassies for further threats
Italy’s Ministry of Foreign Affairs says it has blocked a cyberattack on its website and is checking embassy sites for related threats. The ministry is pushing for EU action to identify those responsible.
Ross Grant3 min read
The short version
Italy’s Foreign Ministry says it blocked a cyberattack on its main website and is checking embassy and consulate sites for further threats. No group has claimed responsibility, but similar attacks in the past have been linked to pro-Russian hacktivists. The ministry is working with EU partners to identify those behind the attack and to strengthen defences.
What happened?
Italy’s Ministry of Foreign Affairs reported on 8 October 2026 that its website was under cyberattack. The ministry says its defences have so far kept the site running, and it is checking embassy and consulate websites for related threats. The ministry is working with national and EU partners to identify the attackers.
The attack on Italy’s Foreign Ministry
On 8 October 2026, Italy’s Ministry of Foreign Affairs announced it was defending its main website against a cyberattack. According to the ministry, its protection systems have so far kept the site running without disruption. The ministry did not say who was behind the attack or what specific technique was used. It is working with the Polo Strategico Nazionale (Italy’s national cloud hub) and other authorities to monitor the situation [Security Affairs (opens in a new tab)][SC Media (opens in a new tab)].
Embassy and consulate sites under review
The ministry is also checking the websites of Italian embassies and consulates abroad for similar attacks. These sites are important for citizens overseas, providing information on appointments, emergencies, and contact details. If an embassy or consulate site goes offline, it can cause real problems for people who need help, especially during a crisis. There is also a risk that attackers could use fake or compromised embassy sites for scams, such as phishing.
Past incidents and likely culprits
No group has claimed responsibility for this attack. However, Italian government sites have been targeted before, often by pro-Russian hacktivist groups. The group NoName057(16) has a history of launching distributed denial-of-service (DDoS) attacks on Italian institutions. In January 2025, as Ukraine’s President Zelensky visited Rome, government sites, banks, and ports were hit. In late December 2024, the Foreign Ministry’s website was taken down by Russian hackers, according to news agency ANSA, but was restored the next day. These attacks tend to coincide with political events and are usually aimed at making websites unavailable, rather than stealing data.
The ministry’s response and EU action
Foreign Minister Antonio Tajani said that cybersecurity has become a central part of the ministry’s work since a reform last year. The ministry has strengthened its ability to prevent, monitor, and respond to threats, including by improving its technology. Italy is also working with Romania and other EU countries to propose new measures at the European level. The goal is to identify and name those responsible for cyberattacks against EU institutions, making it harder for attackers to act without consequences.
What happens next
At this stage, the attack has not caused disruption to the ministry’s main website, and there is no public evidence of data loss or compromise. Analysts are still reviewing embassy and consulate sites for signs of related attacks. The ministry’s focus is on keeping services running and working with EU partners to improve attribution and deterrence. For ordinary users, the main risk is temporary loss of access to official information or, in rare cases, falling for scams if attackers set up fake embassy sites.
Practical advice for readers
If you need to use an embassy or consulate website, check that you are on the official government domain. Be wary of any site that asks for sensitive information or looks unusual. If a site is down, try to contact the embassy by phone or through official social media channels. For organisations, this incident is a reminder to review DDoS protection and have clear plans for communicating with users during outages.
Claimed vs confirmed
- Confirmed
Italy’s Foreign Ministry website was under cyberattack on 8 October 2026.
The ministry itself reported the attack and said its defences kept the site running.
- Unconfirmed
Pro-Russian hacktivist group NoName057(16) is responsible for the attack.
No group has claimed responsibility for this attack, but similar attacks have been linked to NoName057(16) in the past.
The impact
- Money
- There is no public estimate of financial loss. However, under EU law, government agencies could face costs for incident response and, in some cases, regulatory scrutiny if personal data is affected.
- Reputation
- Repeated attacks on government sites can harm public trust, especially if embassy or consulate services are disrupted during a crisis.
- Customers
- Citizens needing embassy or consulate services may face delays or risk falling for scams if attackers set up fake sites. Users should check they are on official domains and use alternative contact methods if needed.
Why it matters
Government websites are essential for citizens, especially those abroad who rely on embassy and consulate sites for help and information. Disruptions can cause real problems and may be used as cover for scams. The incident highlights the ongoing threat of politically motivated cyberattacks on public services.
How does it work?
The sources suggest the attack may be a distributed denial-of-service (DDoS) attack, which floods a website with traffic to make it unavailable. DDoS attacks do not usually involve data theft, but can disrupt access to online services.
Key points
- Italy’s Foreign Ministry blocked a cyberattack on its website.
- Embassy and consulate sites are being checked for related threats.
- No group has claimed responsibility, but pro-Russian hacktivists have targeted Italy before.
- The ministry is working with EU partners to improve attribution and deterrence.
- DDoS attacks disrupt access but do not usually steal data.
Sources
Security Affairs
Reference
SC Media
Reference
