Pro-Russian hackers leak data on Italy's foreign minister, other officials

Italian Foreign Minister Antonio Tajani said on Saturday that his personal data has been spread on the dark web and that he and his family are being threatened. The Record has since reported that the operation is tied to NoName057(16), a hacktivist group aligned with Russia, and, citing cybersecurity researchers, that a dedicated dark web site lists personal details of 18 people, including European politicians, police officials and journalists. Russia's embassy in Italy has dismissed the allegations.

What did Tajani say?

In a social media post, Tajani said cybercriminals had spent days publishing his data and seeking more, and that they were prepared to pay for details about him and his relatives, according to the Associated Press and Al Jazeera, which drew on AFP. He did not say what information had been exposed, and the Associated Press noted that he did not name a culprit in that post. "I will not allow myself to be intimidated in any way," he said, in the Associated Press translation. Al Jazeera reports that he described Italy's position on Ukraine as the political reason he had been targeted, and suggested the threats may also be a reaction to Italy's push to strengthen the Foreign Ministry's digital defences.

Prime Minister Giorgia Meloni blamed pro-Russian hackers and expressed solidarity with him, calling attempts to sell confidential information about government officials "a matter of grave concern", Al Jazeera reported.

Who is on the list, and who is behind it?

The Record, citing cybersecurity researchers who examined the material, says the profiles hold contact details such as phones and emails, social media handles and sometimes residential addresses, and that the group offered cryptocurrency to anyone who supplies further information on the targets or their families. Those reportedly listed include Eurojust President Michael Schmid, Europol cybercrime centre chief Edvardas Sileris and Holger Münch, president of Germany's Federal Criminal Police Office. Also named are Francesco Lo Voi, a prosecutor in Rome, Ivano Gabrielli, who heads Italy's Postal Police, Paolo Tassan-Zanin, the mayor of Aviano, whose town hosts a major US and NATO air base, and three German journalists whose work has covered Russian hackers and influence operations.

The Record says the campaign appears to be retaliation for a July 2025 operation, coordinated by Europol and Eurojust with authorities from 12 countries, that took more than 100 servers used by NoName057(16) offline. Italian media reported that several people on the list worked on that case, and Italian prosecutors are investigating the publication of the data, The Record added.

The Record does not say who made the link to the group, and none of the three reports cites Italian authorities naming it. The Record also reports that Tajani separated the hackers from Moscow: he said he had called the hackers pro-Russian, not blamed the Russian government. When Italian news agency ANSA asked about the case, the Russian Embassy in Italy dismissed the allegations, saying it stays away from the dark web, where it had heard drugs are traded.

What is NoName057(16)?

According to The Record, the group emerged following Russia's 2022 full-scale invasion of Ukraine and mainly runs distributed denial-of-service attacks that knock websites offline. It signs up volunteers via Telegram and offers crypto payments to those who take part in attacks. Cybersecurity firm DarkOwl said in an October report that the group had started running a paid platform on the Tor network for collecting information, and posting a list of foreign individuals it sees as hostile to Russia. Unnamed researchers quoted by The Record call it "one of the most prolific hacktivist actors observed", with a steady run of denial-of-service claims against NATO and EU states that support Ukraine. The Record says it has kept claiming attacks on European targets despite last year's crackdown.

What about the G7 meeting?

Tajani said on Sunday that foreign ministers of the Group of 7 would take up the recent cyberattacks blamed on pro-Russian groups, along with potential joint measures, at a Paris meeting on Monday and Tuesday, The Record reported. The cited reports do not say what the ministers decided.

His statement came amid a run of incidents in Europe reported by the Associated Press and Al Jazeera: hoax bomb threats that led to diverted flights and security alerts at broadcasters, plus attacks on refrigeration systems in supermarkets. The Associated Press also mentions drone incursions. Neither outlet tied these events to the leak. The Record adds that NoName057(16) and another pro-Russian group claimed the refrigeration incidents, claims that have not been independently verified and that researchers advise against attributing without more technical evidence.