Hackers break into Italian PM Meloni's parliamentary email account

Attackers broke into the email system of Italy's Chamber of Deputies overnight into 27 October and got into three lawmakers' mailboxes, one of them the parliamentary account of Prime Minister Giorgia Meloni. The other two belong to Andrea Delmastro of Brothers of Italy, a former justice undersecretary, and Paolo Formentini of the League. The Chamber's administrative and political leadership confirmed the intrusion to Corriere della Sera, according to Il Giornale. Meloni's office says the account is not the one she uses for government business.

How the Chamber of Deputies responded

The Chamber said it had taken all protective measures together with the National Cybersecurity Agency (ACN), under a protocol the two signed during the current legislature, and warned that some IT functions might be switched off for a while. ANSA reported that the Chamber's technicians isolated the affected systems, blocked the malicious activity and were installing security patches.

Officially, the tone was calm. As quoted by Security Affairs, the Chamber said the incident had no emergency implications and that attacks of this kind happen daily, though attempts against Italian, European and international institutions had grown more frequent in recent days. According to ANSA, earlier attempts against the Chamber had all been stopped. This time attackers got as far as lawmakers' inboxes.

Palazzo Chigi, the prime minister's office, said Meloni's address as premier is separate and better protected, and was not touched. ANSA added that the parliamentary mailbox is monitored and receives a large volume of mail addressed to her.

What is still unknown about the email breach

• How they got in: no outlet has described the method, whether phishing, stolen passwords or a software flaw.
• What they saw: it is not public whether messages were read or copied.
• Who did it: nobody has claimed the attack, and no one has been named.

Rome prosecutors are waiting for a first report from the Postal Police, Italy's cybercrime unit, before opening a case for unauthorised access to a computer system. ANSA says investigators are also checking whether the same source is behind attempts on other Italian and foreign institutions.

Suspicion of a hybrid-war operation

Il Giornale reports a suspicion within the governing majority that the break-in is part of the "hybrid war" operations that have recently hit other European parliaments' websites. Defence Minister Guido Crosetto has repeatedly warned about such operations. On 8 October a DDoS attack, which ANSA says was claimed by the pro-Russian group NoName057(16), hit the Foreign Ministry's website. Security Affairs notes there is no public evidence linking the two incidents, and a DDoS, which floods a site with traffic, is a different kind of attack from getting inside a mailbox.

A lawmaker's mailbox is valuable even if it holds nothing secret. It shows contacts, schedules and drafts, and a message sent from a real official address is far more convincing than a fake one. In September an Italian case showed how that plays out: forged orders sent from a compromised interior ministry mailbox persuaded Revolut to hand over customer data. Anyone who has written to the three deputies recently should treat unexpected replies or requests from those addresses with caution until the Chamber says the accounts are clean.