Italian Authorities Confirm Journalist’s Phone Was Hacked in Spyware Scandal

Prosecutors in Rome and Naples, Italy, confirmed that Francesco Cancellato, a journalist, received spyware on his phone last year, leading to the hack of said device. 

According to a Thursday press release, a technical report discovered traces of spyware on phones belonging to Cancellato and two immigrant activists, Giuseppe Caccia and Luca Casarini. 

The Coordinated Hack Attack Using Spyware

The report acknowledged three separate hacks, all of which happened in the early hours of December 14, 2024. The weird timing suggests they were part of one campaign. 

This marks the first independent confirmation for Cancellato, who runs a news site called FanPage. Last January, he and 90 others received a WhatsApp alert that Paragon spyware had targeted them. Specifically, the Paragon spyware is a product of Paragon Solutions, an Israeli company now under the umbrella of a US private equity firm.

While this case involves sophisticated state-grade spyware, the broader landscape of digital threats has shifted toward more accessible platforms. researchers now find that Telegram has replaced the dark web as the top medium for trading stolen data, making tools like Paragon’s Graphite just one piece of a much larger, more accessible cybercriminal ecosystem.

Italian judicial authorities checked Paragon spyware’s server, which the intelligence agency AISI uses, and found proof of operation against Casarini and Caccia. However, they didn’t find anything against Cancellato. 

For now, no one knows who exactly hacked into Cancellato’s phone.

Government Denies Having Anything to do with the Hack

Last July, probes by the Italian parliamentary security committee, COPASIR, concluded that intelligence targeted the two activists lawfully. However, similar to the recent technical report, back then, the committee found no proof of any hack against Cancellato.

Prosecutors said they won’t back down. They’ll keep probing into the matter until they clear things up and find out who hacked Cancellato’s phone. The Italian Government itself denied any role in the hack. Prime Minister Giorgia Meloni told the press they’re willing to assist in any way they can to clarify things. 

Cancellato expressed his irritation over the matter in an article on Thursday. He said they’re asking for clarity, but the government hasn’t provided any. He accused the government of remaining silent for a year and lying when they eventually spoke.

Citizen Lab researcher John Scott-Railton, who looked into the Italian Paragon cases, said the new finding raises eyebrows. He wondered why initial investigations did not confirm the hack on Cancellato.

Paragon, the maker of the spyware Graphite, has responded to the scandal by canceling its contracts with its Italian government customers.

Findings Raise More Questions than Answers

Cancellato, Caccia, and Casarini aren’t the only spyware victims in Italy. An employee at Fanpage, Ciro Pellegrino, received an alert from Apple last year concerning a suspected attack on his phone. Researchers at Citizen Lab later concluded that Paragon spyware had hacked him, too.

The new technical report that the prosecutors released, however, only found spyware on the phones of the three. There was no evidence that Pellegrino or four other alleged victims experienced any hack.

Pellegrino said he is bewildered and hasn’t seen the full report yet. He questioned how Citizen Lab, a top figure when it comes to spyware, found evidence of Paragon’s Graphite on his phone, yet the prosecutors’ experts didn’t. He couldn’t figure out why Apple kept sending him alerts if no one actually tried to hack him.

Meanwhile, the Polizia Postale, in charge of the investigation, they just pointed questions back to the prosecutors.

The prosecutors in Naples and Rome didn’t reply to any requests for comment, nor did Paragon. Also, the RedLattice, the company that merged with Paragon after the US equity firm acquired it, hasn’t commented either.

Spyware Scandals Across Europe

Now Italy’s dealing with its own spyware scandal, just like Poland, Greece, Spain, and Hungary have in the past few years.

Just last month, a court in Greece sentenced Tal Dilian and three other execs from Intellexa, a spyware company, to eight years in prison. Their charges? Illegal wiretapping and privacy violations. The sentencing ties back to what people call the “Greek Watergate.” That all started in 2022, when accusations came out that the Greek government used Intellexa’s Predator spyware to hack the phones of journalists, politicians, business leaders, and even folks in the military.