Attackers went after the IT systems of Italy's Chamber of Deputies at Montecitorio and reached parliamentary email accounts. One of those accounts was assigned to Prime Minister Giorgia Meloni in her role as a Member of Parliament. The Chamber confirmed the attack and said it put protective measures in place with Italy's National Cybersecurity Agency (ACN). Italian reporting says three accounts were affected: Meloni's, former Justice undersecretary Andrea Delmastro's (Brothers of Italy) and Lega lawmaker Paolo Formentini's. Palazzo Chigi says the compromised inbox is not the one Meloni uses for government communications. No one has claimed the attack, and officials have not said whether any data was taken. The Rome Public Prosecutor's Office is waiting for an initial report before it moves its investigation forward.
What Happened
Il Foglio broke the story on 27 October. The paper says the attack was "massive," ran until the afternoon, and also hit other Italian and European institutions. Il Sole 24 Ore calls it a large attack that "affected the entire system" but says the Chamber's technical staff kept it under control. Reuters, via ANSA as cited by the Times of India, says parliamentary technicians contained the incident.
Reports do not agree on how far the attackers got:
- Scale. Il Sole 24 Ore says the attack hit the email accounts of "numerous MPs." The same report, along with Security Affairs and Il Foglio, names only three addresses. Breach Signal cites Analytics Insight as saying other lawmakers' inboxes were also targeted. Officials have not given a total.
- Access to Meloni's account. Il Foglio says Meloni's account was "breached," and Delmastro told the paper, "It's clear that, as an MP, I used that email account." Reuters reported that it was not immediately clear whether Meloni's account had actually been accessed. The Chamber has not said either way.
- Website vs. email. Il Foglio's headline says the Chamber's website was breached. Every other report describes an attack on IT systems and email accounts and does not mention the public website being defaced or compromised.
- Other targets. Il Foglio reports that the attackers also went after the Quirinale, the President's office. No other outlet has confirmed this, and the Quirinale has not commented.
The Chamber played the incident down. Sources at Montecitorio told reporters it was "not an emergency" and that such attacks happen "on a daily basis." They said some system functions and email accounts were deactivated, including Meloni's, and described this as standard practice under a specific protocol with ACN. The same sources also said attacks and pressure on IT systems had increased over the previous few days against other national, European and international institutions. Il Foglio notes that the Chamber was also attacked last year.
What Was Taken
Nothing has been confirmed. Officials have not said whether attackers read messages, downloaded mailbox contents, harvested contact lists or got hold of login credentials. Security Affairs points out that the public information so far does not explain what level of access was gained or whether any information was taken.
The main question is what these mailboxes held. Palazzo Chigi says Meloni does not use her parliamentary inbox for government business, which lowers the chance that state communications were exposed. Delmastro's comment suggests at least some MPs did use their accounts for real work. A parliamentary mailbox can still show who a lawmaker talks to, their schedules and contacts, and the relationships between them, even if it holds nothing sensitive.
Il Foglio raises a further worry: the attackers might use the compromised identities to send email in a lawmaker's name and ask for information or documents. The paper presents this as a capability the attackers could have. It does not say this has happened.
Why It Matters
Defence Minister Guido Crosetto has warned publicly about hybrid warfare against Italy. Il Foglio and Security Affairs both put the incident in that context. Il Foglio says the attack "may reek of vodka," hinting at Russian involvement, but it also says the motive could be selling data. No one has attributed the attack, and there is no technical evidence pointing to any particular actor.
Security Affairs argues that calling the attack routine because attacks are frequent is the wrong way to look at it. How much an incident matters depends on the target, the access obtained and the strategic context. On those terms, a compromised mailbox belonging to a sitting prime minister matters, whichever account it was. A trusted parliamentary address is also a strong launch point for spear-phishing against other lawmakers, ministries and EU partners. That risk outlasts the first intrusion.
The Chamber says other national, European and international institutions came under increased pressure at the same time. If that is accurate, this was probably one part of a wider campaign and not a one-off attack on Montecitorio.
The Attack Technique
Officials have not said how the attackers got in. There are no reports of the initial access method, malware, exploited vulnerabilities or indicators of compromise. The Chamber's statement that "certain functions" were deactivated suggests it limited webmail or authentication features while it contained the incident.
A recent and unrelated Italian case shows what an email account takeover looks like from the inside. In a GDPR Article 34 notice published on 20 October, the Municipality of Muggiò said an attacker took over the login session of a tax office mailbox on 28 September. The attacker held it for about 30 minutes and sent fraudulent "payment notice" emails carrying the official's name and the council's logo. The attacker also created an inbox rule that moved replies into a different folder so the account owner would not see them. Nothing links the Muggiò case to the Chamber attack. It is a useful reference for the kind of activity investigators will be looking for in parliamentary mailboxes: stolen sessions, hidden forwarding rules and messages sent in the account owner's name.
Regulatory Angle
Under GDPR Article 33, a data controller must notify the Italian data protection authority (the Garante) without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to put people at risk. Article 34 requires the controller to tell affected people directly if the risk is high. Studio Legale Celotti notes that the Garante fined an organisation in 2026 for delaying that notice for reputational reasons. It also notes that the move to a 96-hour deadline proposed in the EU's Digital Omnibus package is only a proposal, so the 72-hour deadline still applies. Fines for breaking notification and security obligations can reach €10 million or 2% of turnover. Separately, Mondaq reports that the European Data Protection Board consulted on a common EU-wide breach notification template, with the consultation closing on 5 August 2026.
The Chamber of Deputies has constitutional autonomy, so it is not clear how GDPR oversight by the Garante applies to its own systems. No notification to the Garante has been reported.
What Organizations Should Do
- Require phishing-resistant MFA on all webmail. Use FIDO2 security keys or passkeys for elected officials, executives and their staff. Session-hijacking attacks get around SMS and app-based codes.
- Check for malicious inbox rules and forwarding. Regularly audit mailbox rules, external forwarding and delegated access. A hidden rule that moves replies elsewhere, as in the Muggiò case, is a clear sign of an account takeover.
- Shorten session lifetimes and revoke tokens after an incident. Bind sessions to the user's device where possible. After any suspected compromise, revoke refresh tokens and active sessions, not just the password.
- Separate official and representative mail. Make it clear which accounts may carry government business. Dormant or secondary accounts, like Meloni's parliamentary inbox, still need full monitoring, or they should be shut down.
- Prepare contacts for impersonation. After a compromise, tell frequent correspondents to verify by phone any request for documents, payments or credentials that appears to come from the affected accounts.
- Rehearse the 72-hour notification process. Have the GDPR Article 33 and 34 decision, the risk assessment and the internal breach log ready before an incident happens.
Sources: Hacker attack: the Chamber of Deputies’ website and Meloni’s email... | Italy’s Parliament Under Cyber Pressure: Why the Attack on the Cham... | Hacker attacks on the Chamber of Deputies: email accounts targeted,... | Hackers target Italy Chamber of Deputies email accounts | Giorgia Meloni's email targeted in cyberattack on Italian ... | Violazione di dati personali in una casella di posta del Servizio T... | Data breach notifica Garante: obblighi, 72 ore e sanzioni | Data Breach Notification: What Changes With The EDPB Common Templat...