Hoax bomb threats and hacks hit flights and fridges as Italy's cyber incidents rise 47%

Flights and supermarket fridges targeted

Between 2 and 5 November, 28 European flights received bomb threats by email, some of them written in Italian. A Dublin to Rome flight made an emergency landing in France and a Milan to Warsaw flight was diverted to Vienna, while Italian fighters escorted a passenger jet to Fiumicino. All the threats were false, and each diverted flight costs between 55,000 and 75,000 euros. In the same days, display fridges in supermarkets in eight European countries, Italy included, were manipulated until they reached 50 degrees, and the stock was thrown away. Two pro-Russian groups, NoName057 and Z-Pentest, claimed the fridge attacks in a video.

Fake alerts and a foiled blood bank attack

On the night between 1 and 2 November, phones belonging to Russian and Ukrainian citizens received false alerts about nuclear and chemical raids through official emergency apps. Kyiv and Moscow later said cyber attacks had targeted their alert systems. On 4 November, an attack aimed at raising temperatures in several French blood banks was foiled in time. At least 27 alerts about explosives on board aircraft were reported on 5 November.

Cyber incidents in Italy climb

The national cybersecurity agency handled 2,171 events in the first half of 2026, up 47% from 1,474 a year earlier, and 1,072 of them had a confirmed impact. September recorded 485 events against 309 in August, while incidents rose to 235 from 196. The agency said the increase does not signal a real rise in the threat, but better detection and handling of events that might once have gone unnoticed.

H1 20251,474

H1 20262,171

H1 2025

1474

H1 2026

2171

Data from the article text

Ransomware cases fell 12% to 181, while credential compromise, data exposure and vulnerability exploitation grew. Manufacturing, technology and healthcare were the most affected sectors.

2026-08309

2026-09485

2026-08

309

2026-09

485

Data from the article text

Hacktivists and the wider picture

DDoS attacks, which had stopped in June, July and August, resumed in September, mostly against local public administrations, with impacts confirmed in 8.3% of cases. A pro-Russian group claimed them in response to Italian military aid to Ukraine. The Clusit report counted 4,911 serious cyber incidents worldwide in the first half of 2026, the highest number ever recorded for a half-year, with Italy accounting for 245. The same report says health data is among the targets and is sold on the dark web every year.

Government response and attribution

Defence minister Guido Crosetto calls the campaign a 'sotto soglia' hybrid war, one kept below the threshold that allows attribution, and links the email hoaxes, the fridge attacks and foiled drone attacks in Leipzig.

“They are part of a strategy to generate chaos.”

Andrea Quacivi, director of the national cybersecurity agency, told parliament that the combined effect of alarms, which still need verification, and a more complex threat could weigh on the country.

“It can produce effects on the reliability of services, on citizens' trust and, more generally, on the stability of the country's system.”

Meloni's government is trying to identify who is behind the campaign, and the Lega has repeatedly denied hypothetical Moscow involvement. Guerini, president of the Copasir intelligence committee, said the Russian lead is still being examined and that attribution in cyberspace is very complicated. Opposition parties said the government should explain which tools it has, not just denounce the threat.