Italy's anti-mafia agency DIA probes alleged hack and dark web sale of files

What the seller claims

A seller signing as 'weykofa' has offered an archive of 222 MB on the dark web, saying it was taken from the Direzione investigativa antimafia (DIA), the interforce body that investigates organised crime. According to the listing, the package holds 302 files on 25 criminal groups, including operational dossiers, investigation records, internal statistics, staff data and financial documents. Some social media posts gave looser figures of about 300 files and more than twenty groups, which reflects early descriptions rather than a confirmed count. The seller is also said to have included correspondence with Europol and EU institutions, unpublished photographs of police operations and press releases still under embargo. The seller wants payment in bitcoin, and Fanpage and Il Sole 24 ORE add that Monero is accepted too. If the material were confirmed, it could expose sources, undo months of investigative work and damage international cooperation networks.

How the claim surfaced

The claim was reposted on X on Sunday 8 November at 18:41 by Dark Web Informer, an account that monitors illicit online markets, which flagged it as unverified. Decripto looked into the listing, and Fanpage said it had contacted the DIA and was waiting for a reply. Italian outlets picked up the story on Monday 9 November, but neither the DIA nor the Interior Ministry had issued official confirmation. Fanpage framed the episode as the latest in a difficult stretch for Italian and European systems. The timeline below sets out the key dates reported so far.

What remains unverified

No readable sample of the files has been published, so nobody can yet check whether the archive exists or whether its contents are authentic. Investigators are still trying to establish when any intrusion happened and which documents, if any, were taken. Another possibility is that the seller assembled documents that were already public and presented them as a leak, a pattern common in criminal data markets where genuine sales, scams and recycled databases coexist. The name has not been linked to earlier data sales in the searches carried out so far. Most reports give the archive size as 222 MB, although one outlet wrote over 220 MB. Only direct analysis of the files, together with technical and institutional checks, could separate a real breach from a constructed claim.

Wider European attacks and the Rome meeting

The claim comes against a wave of cyber incidents across several European countries in the weeks leading up to 9 November, reportedly including hoax bomb threats against airlines and schools, sabotage of refrigeration systems, and disruption of transport companies' operating systems. Reporting says Europol is cross-checking these incidents, and European institutions are preparing to share information and analyse it jointly. No sufficient evidence yet links the DIA claim to those attacks, although a connection has not been ruled out. The G7 foreign ministers met in Paris on 9 November, where Antonio Tajani and Jean-Noel Barrot had asked for hybrid warfare to be discussed. Interior Minister Matteo Piantedosi has convened the National Committee for Public Order and Security at the Viminale for 10 November, with heads of police and intelligence expected to attend.