Researchers explore why cyberattacks hit Italy at high rates

Italy is experiencing a disproportionately high rate of cyber attacks, with threat patterns in the country markedly diverging from other regions. Dark Reading cites three theories from researchers, led by Intel471 analyst Gianluca Tiepolo, to explain the anomaly.

In exclusive Intel471 data, Italian organisations account for about 7% of initial access data sold on criminal forums, versus 30% globally, placing Italy second only to the United States in overall exposure and making it the fourth most targeted country for ransomware. The report notes that initial access brokers in Italy frequently exploit vulnerabilities (57% of cases), while credential stuffing accounts for about 23%. Access to victims’ web infrastructure is resold in roughly 49% of cases, with remote access and desktop remote tools representing 26%.

The article outlines three theories to rationalise the findings. Theory 1 points to weak security hygiene and delayed adoption of security technologies in Italy, citing late uptake of EDR solutions (around 2020–21). Theory 2 considers a network effect: widespread use of particular technologies combined with slow patching could make Italy an attractive economy of scale for attackers, allowing reuse of tools and infrastructure across multiple targets.

Theory 3 highlights the prominence of micro, small and medium enterprises in Italy (MSME), suggesting smaller organisations may be disproportionately targeted in extortion campaigns. Cleafy, Milano-based, corroborates similar patterns, noting attackers reuse tools and infrastructure to expand campaigns across Italian financial targets, citing drIBAN and PEC-related abuses as examples.

The reporting emphasises that these patterns differ from global trends, with IAB data showing far greater credential-based activity in Italy relative to other regions. The article is dated 30 October 2026.