Italy’s Chamber of Deputies: mailboxes hit, Meloni’s included

On 27 October 2026 Italy’s Chamber of Deputies confirmed an attack on its IT systems that involved several parliamentary email accounts, including the one assigned to Giorgia Meloni. According to Security Affairs and Agenda Digitale, three accounts were affected: Meloni’s and those of deputies Andrea Delmastro and Paolo Formentini. The Chamber activated security measures together with Italy’s National Cybersecurity Agency (ACN).

The three available sources are analysis pieces: two are by the same author (Pierluigi Paganini, on Cybersecurity360 and Security Affairs), the third is from Agenda Digitale, which also draws on ANSA and Quotidiano Nazionale. As of the morning of 28 October, according to Agenda Digitale, the technical vector had not been confirmed and there were no verified claims of responsibility.

What happened

• The official statements. Sources at Montecitorio described the incident as having no «emergency» character, because attempts of this kind occur every day. The Chamber added, Security Affairs reports, that pressure on IT systems had recently intensified against other Italian, European and international institutions as well.
• Meloni’s mailbox. Palazzo Chigi, the Prime Minister’s office, clarified that it is not the account she uses for government communications. According to Agenda Digitale, however, the same statement describes it as «constantly monitored» and receiving a lot of correspondence.
• Access or attempt? Here the sources diverge. Agenda Digitale writes that Montecitorio sources confirmed unauthorised access. Security Affairs, by contrast, notes that public information does not yet make it possible to tell a blocked attempt from a compromise, nor to establish the level of access obtained or whether any data was taken.

Technical details

No CVEs, affected products or indicators of compromise have been disclosed. The most concrete technical element comes from ANSA, quoted by Agenda Digitale: on the evening of 27 October, technicians from the Chamber and the ACN were working to isolate systems, block malicious activity, remove vulnerabilities, restore compromised functions and apply security patches. These are the containment, eradication and recovery phases of a real incident; patching suggests a vulnerability in a software component, but which one (webmail, an exposed service or something else) has not been stated.

On attribution:

• according to what has leaked from the investigation, as reported by Agenda Digitale, a Russian origin is currently ruled out;
• the pro-Russian group NoName057(16) had also hit mobile.camera.it with a DDoS attack on 13 October (Agenda Digitale), and on 8 October the Foreign Ministry suffered a DDoS that media linked to pro-Russian actors (Security Affairs). Both sources stress that a DDoS is a different operation from a mailbox intrusion and that there is no evidence of a link.

On the judicial side, Agenda Digitale reports that the Rome prosecutor’s office is ready to open a case for unauthorised access to a computer system (article 615-ter of the Italian Criminal Code) once the Postal Police report arrives; the ACN has not issued its own statement.

Context comes from the ACN’s September Operational Summary (published on 23 October), cited by Agenda Digitale: mailbox compromise is among the most frequent threats in Italy, together with DDoS and phishing; in the month 235 incidents were handled (+39% on August) and 253 compromised accounts belonging to institutional bodies were identified, largely through data collected by infostealers. The main entry vectors listed by the Agency are vulnerability exploitation, phishing and spear phishing, and the use of valid credentials. No source links these figures to the attack on the Chamber.

Until the vector is known, the MITRE ATT&CK techniques to watch are those typical of email attacks: exploitation of public-facing applications (T1190), valid accounts (T1078), phishing (T1566) and email collection, including forwarding rules (T1114).

Impact for European and Italian companies

A mailbox, even when it is not the «main» one, holds contacts, relationships, calendars and documents. Security Affairs points out that a compromised account becomes a springboard: messages sent from a legitimate address look trustworthy and help targeted phishing and impersonation against colleagues and partners. The same applies to executives’ mailboxes in any company.

Agenda Digitale recalls Law 90/2024, which requires Italy’s central public administrations to report significant incidents to the ACN within 24 hours and notify them within 72. The Chamber, as a constitutional body, cooperates with the ACN through a memorandum of understanding (signed in 2023 and renewed in February 2026) whose contents are not public. For companies within the scope of NIS2 (in Italy, Legislative Decree 138/2024), unauthorised access to executives’ mailboxes must be assessed under the company’s incident classification procedure and, if significant, notified within the required deadlines; if personal data is involved, the GDPR applies too.

What to do now

1. Strong authentication on webmail and remote mail access, with phishing-resistant factors for executives and mail administrators; disable basic authentication protocols where they are not needed.
2. Update the exposed mail components: webmail, servers, gateways and reverse proxies.
3. Look for company credentials in infostealer data and reset any you find immediately, revoking active sessions.
4. Check forwarding and mailbox rules, delegations and authorised apps on executives’ accounts: they are the most common way to keep reading mail after a password change.
5. Monitor sign-ins: new countries or providers, unusual IMAP or webmail access, mass message downloads.
6. Disable mailboxes no longer in use, or protect and monitor them like active ones.
7. Prepare the response: a written incident classification, notification thresholds, deadlines (24 and 72 hours) and a single version of the facts shared by technical staff and communications.

How ARXDOME helps

ARX Expose shows what an attacker sees from the outside, including vulnerable exposed services and company accounts involved in known breaches. ARX Sentry collects logs and events from servers and firewalls, useful for spotting anomalous access; ARX Horizon enriches them with country, provider and threat lists, and ARX Shield flags open vulnerabilities on monitored machines.

Last updated: 28 October 2026