How many cyberattacks has Italy really had this year? At the beginning of November several news outlets answered with the same figure: 3,271 in the first nine months of 2026.
It is a figure from ACN, Italy’s National Cybersecurity Agency (Agenzia per la cybersicurezza nazionale). But ACN counts “events,” that is, reports, and the comparison with last year, which the outlets set beside it, seems to point to strong growth. It does not say, though, whether attacks have increased: since January more companies have been required to report incidents, and the Agency counts more of them.
In short: “Events” are reports of something anomalous; “incidents” are a subset, those with confirmed impact. The events nearly match ACN’s monthly reports; the incidents do not. The comparison with 2025 does not say whether attacks are increasing.
Events and incidents
What does ACN count, then? Two things. “Events” are reports of something anomalous on the systems of companies and public bodies: they reach Italy’s CSIRT, the national center that receives incident reports, or are detected by the center itself. “Incidents” are, for ACN, events with confirmed impact.
It follows that incidents are a subset of events, and that an event is not always a successful attack. That is a deduction, not a sentence from ACN, which, in the documents read, does not define “event.”
The “3,271” comes from a Senate hearing on October 13: ACN’s director said it, along with other figures you will find in the table below.
Euronews picked it up speaking of “breaches” and of “cyberattacks,” words different from “events.”
Month by month
Each month ACN publishes a report with the month’s figures and sometimes revises those of earlier months: the table shows the latest version of each month. The revisions can be large: January’s incidents, for example, go from 39 in the first publication to 110 in the last.
| Month (2026) | Events | Incidents |
|---|---|---|
| January | 225 | 110 |
| February | 435 | 159 |
| March | 434 | 286 |
| April | 266 | 174 |
| May | 389 | 161 |
| June | 421 | 179 |
| July | 305 | 188 |
| August | 309 | 196 |
| September | 485 | 235 |
| Total of the reports | 3,269 | 1,688 |
| Stated to the Senate on October 13 | 3,271 | 1,922 |
Chart 1. Events and incidents in Italy, month by month, January–September 2026 (ACN, monthly reports; analysis: Bruno).
The events nearly match: the sum of the months is 3,269, against the Senate’s 3,271.
The incidents, instead, do not: the reports give 1,688, the director indicated 1,922. ACN does not explain the difference.
One piece of context: the director spoke on October 13, and the September report was announced on October 23.
And the coming months? For October, November and December ACN forecasts, with a statistical model, between 346 and 432 events a month and around 225 incidents; it warns, however, that the forecast “cannot be accurate.”
The comparison with 2025
And the comparison with 2025? It says less than it seems, and the reason is NIS2, the European directive on the security of networks and services, which has been fully operational since January.
The director says so too: 21,500 entities fall under NIS2, the great majority of them private, and in the first nine months of 2026 more than 1,500 notifications arrived, which for many organizations meant their first contact with the Agency.
In the numbers it shows like this: from May to December 2025 about one event in four was an incident, in 2026 more than one in two, and incidents per month are more than triple.
| Period | Events per month | Incidents per month | Incidents per 100 events |
|---|---|---|---|
| May–December 2025 | 235 | 55 | 23.5 |
| January–September 2026 | 363 | 188 | 52 |
For 2025 the table starts in May, because the November and December reports also cover the six preceding months.
Then there is the duration. The news outlets set the 2,729 of the whole of 2025, which is twelve months, beside this year’s 3,271, which is nine: it is not a like-for-like comparison.
The 2,729 is not certain either: adding up the two half-year reports ACN published for last year gives 2,802 events, 73 more, and the difference is not explained.
ACN adds that more visibility does not mean more damage: the impacts of incidents are in line with the average of the previous months. More reports, therefore, are consistent with more companies being required to report; they neither prove nor rule out a real increase in attacks.
September
And September? It is the month with the most events, 485 against August’s 309, and ACN points to two causes. The first is DDoS attacks, which overload a site to make it unreachable, here carried out by groups with political motives.
According to ACN, a pro-Russian group claimed them, stating that it was responding to Italy’s military support for Ukraine. The effects were limited: impacts ascertained “in only 8.3% of cases.”
The second cause is defacements, that is, the unauthorized alteration of a site’s pages, achieved by exploiting flaws in the programs that run it and in their extensions.
Ransomware, the program that encrypts data and demands a ransom, remains, for ACN, the most significant threat in terms of operational impacts.
In September it hit mainly the technology, retail and manufacturing sectors, and initial access came through vulnerabilities, previously compromised credentials and remote-access services. That month, ACN writes, among the ransomware incidents the one with the most significant consequences hit a hospital complex: one site was temporarily closed, and at the other patient management was limited.
If you have a website
And if you have a website, even a blog or an online store, what can you do? ACN lists the main countermeasures in its September document.
Against defacement: update right away the program that runs the site and its extensions, check for unauthorized changes to files, keep backups in a separate environment, and give people who access the site only the permissions they need.
Against DDoS you need an anti-DDoS service from your own provider, a response plan, and more than one internet connection, to have a backup. For ransomware, ACN refers to a dedicated document on its site.
The “3,271” is not the number of attacks: it is the events ACN sees, and since January it sees more of them.
Frequently asked questions
How many cyberattacks have there been in Italy in 2026?
No figure says so. From January to September ACN records 3,269 events and 1,688 incidents in its monthly reports; the director indicated 3,271 and 1,922 to the Senate. They are events, that is, reports, not a count of attacks.
What is the difference between an event and an incident?
An event is a report of something anomalous; an incident is an event with confirmed impact. In September, out of 485 events, 235 were classified as incidents.
Have attacks increased compared with 2025?
This comparison does not say: since January NIS2 has made more companies report, so ACN sees more. A real increase can be neither ruled out nor demonstrated.
What is NIS2?
The European directive on the security of networks and services, transposed in Italy in 2024. It requires many entities to report incidents, fully operational since January 2026.
Methodology note
Totals, averages and percentages are calculations on ACN data, using the latest published version of each month (with the first publications the totals would be 3,275 and 1,650). The 2025 data come from the November and December reports. The record of the hearing is not among the sources consulted: the director’s words are those reported by ACN. Quotations from Italian-language sources are translations.
Sources
Accessed November 13, 2026. Titles of Italian-language sources are given in the original Italian.
- ACN, “Operational Summary – settembre 2026,” PDF. Primary. https://www.acn.gov.it/portale/documents/20119/1176749/Operational_Summary_set26_CLEAR.pdf/b3d456ce-faa5-6d7f-29f0-0ee290fc6cbd?t=1792763702356
- ACN, monthly Operational Summaries (January–September 2026; November and December 2025). Primary. https://www.acn.gov.it/portale/operational-summary
- ACN, news item on the director’s hearing before the Foreign Affairs and Defense Committee, October 14, 2026. Primary. https://www.acn.gov.it/portale/en/w/il-direttore-acn-andrea-quacivi-in-commissione-affari-esteri-e-difesa
- ACN, news item on the director’s hearing before the banking inquiry committee, November 5, 2026. Primary. https://www.acn.gov.it/portale/web/guest/-/il-direttore-andrea-quacivi-in-audizione-presso-la-commissione-parlamentare-di-inchiesta-sul-sistema-bancario-finanziario-e-assicurativo
- ACN, Operational Summary, first and second half of 2025. Primary (copies). https://www.key4biz.it/wp-content/uploads/2025/08/Operational_Summary_H1_2025_CLEAR.pdf ; https://www.cybersecitalia.it/wp-content/uploads/2026/01/Operational_Summary_H2_CLEAR.pdf
- Arena Digitale, November 11, 2026. Secondary. https://arenadigitale.it/2026/11/11/cyberattacchi-nei-primi-nove-mesi-del-2026-sono-3-271-gli-eventi-in-italia/
- Euronews, November 9 and 10, 2026. Secondary. https://it.euronews.com/2026/11/09/italia-nessun-attacco-hacker-ai-sistemi-della-dia-verifiche-in-corso-su-dark-web-dice-mini ; https://it.euronews.com/2026/11/10/italia-riunione-comitato-per-la-sicurezza-gli-hacker-puntano-a-colpire-le-istituzioni
- Affaritaliani, November 10, 2026. Secondary. https://www.affaritaliani.it/techdigital/cyberattacchi-3-271-eventi-in-nove-mesi-nel-mirino-ospedali-e-trasporti-lintero-2025-si-fermava-a-2-729.html
Have your say