Cybersecurity threats against the Italian financial sector surged in the first nine months of 2026, with the National Cybersecurity Agency (ACN) recording 168 cyber events targeting banks and insurance companies.
According to Il Sole 24 ORE, 47 of these events were classified as confirmed incidents with a direct operational impact.
Digital communication channels serve as the most frequent entry point for attackers, according to the ACN. The agency noted that email has been the privileged channel for these intrusions over the last nine months. Cybersecurity threats now extend beyond traditional hacking, similar to recent digital hoaxes targeting schools and airlines.
Il Sole 24 ORE reports that the banking sector faced 137 of the total 168 events, while the insurance industry accounted for 31. Beyond cyber-specific threats, the ACN noted that 12 of the 47 confirmed incidents in the banking sector resulted from non-cyber operational failures, such as technical hardware breakdowns, a reality highlighted by ACN director Quacivi during his testimony to the parliamentary inquiry on the Italian banking system.
Two primary bodies coordinate the Italian financial system’s response to these threats: CertFin and CODISE. Established in 2003, CODISE is chaired by the Bank of Italy and includes Consob and major financial operators, as noted by HANDLE. Its mandate focuses on maintaining operational continuity and protecting public confidence in the currency. The body conducts regular resilience exercises and threat scenario analysis to prepare for systemic shocks.
CertFin operates through a public-private partnership involving the Bank of Italy, the Italian Banking Association (ABI), IVASS, ANIA, and Consob. It supports banks, insurers, and market infrastructure by promoting the sharing of operational information and technical expertise. The organization provides direct support to entities during security events, helping them coordinate responses to prevent broader systemic impact.
The Daily Fact reports that while authorities identify some groups as state-aligned actors linked to Russia, Iran, or North Korea, investigators have yet to find definitive "smoking gun" evidence linking specific criminal gangs to national intelligence structures.
The ACN identified nearly 45,000 assets and services at risk during the nine-month period, with over 3,200 showing signs of potential compromise, a figure cited by Quacivi during an October 13 Senate hearing regarding legislative efforts to bolster national defense.
What is the role of CODISE during a financial crisis? CODISE facilitates information exchange and coordinates emergency measures to prevent systemic disruptions. It was notably activated in late 2024 following a cable failure in Switzerland that interrupted credit and debit card payments across Italy, according to HANDLE.
How do banks and insurance companies differ in their threat profiles?
Data from the ACN indicates that 64% of bank-targeted events originate from cybercriminal groups, whereas 83% of events targeting insurance companies are attributed to hacktivist groups, typically involving DDoS attacks, as reported by Il Sole 24 ORE.
Are these attacks part of a broader hybrid warfare strategy?
While security services note a significant increase in Russian-linked infrastructure attacks across Europe between 2023 and 2025, experts like Andrea Saracino of the Sant’Anna School of Advanced Studies suggest that most financial cyberattacks are driven by criminal profit motives rather than political destabilization, according to The Daily Fact.
Keep reading