Italy’s Foreign Minister Antonio Tajani says hackers targeted him and his family, while the company building the Brenner Base Tunnel has confirmed a separate cyberattack. The incidents have raised fresh concerns about politically motivated cybercrime, the exposure of personal data and the security of critical infrastructure linking Italy and Austria.
Tajani said on 7 November that cybercriminals had published his personal information on the dark web. He attributed the attack to Italy’s position on Ukraine, although the source content does not identify a confirmed perpetrator in his case.
What happened in the cyberattacks?
In a social media statement, Tajani said hackers had circulated personal data over several days and were seeking additional information. He said the activity had also affected members of his family and created further risks of intimidation.
The minister linked the targeting to Italy’s support for Ukraine and its stated defence of Ukraine’s sovereignty and democratic independence. His comments frame the incident as a potential politically motivated cyberattack, but no official attribution to a specific group was provided in the information available.
Italian Prime Minister Giorgia Meloni expressed support for Tajani. She said the sale of confidential information concerning public officials was a serious concern that required a determined response.
Brenner Base Tunnel company confirms separate breach
BBT SE, the company responsible for the under-construction Brenner Base Tunnel, also confirmed that it had suffered a cyberattack in recent weeks. The incident took place on 17 October, according to the company.
The Brenner Base Tunnel is a planned 55-kilometre rail connection between Innsbruck in Austria and Fortezza in Italy. It is a major cross-border transport project designed to strengthen rail links through the Alps.
BBT SE said the attack involved access to its internet-connected network and that non-public information was stolen. After identifying the incident, the company said it:
- Activated its cybersecurity protocols;
- Isolated the affected systems;
- Engaged external cybersecurity specialists; and
- Started a forensic investigation into what happened.
The company has not publicly confirmed the full scope of the stolen information or whether the incident affected construction operations. Those questions may depend on the outcome of the forensic analysis.
Possible link to a pro-Russian hacker group
Italian newspaper Tiroler Tageszeitung, which first reported the breach, said early investigations pointed towards Everest, a group described as pro-Russian. That attribution remains a reported line of investigation rather than a confirmed official finding in the supplied information.
Cybersecurity investigations can take time, particularly when attackers use stolen credentials, compromised infrastructure or services designed to conceal their location. A suspected group should therefore not be treated as definitively responsible until investigators or relevant authorities publish supporting evidence.
Why the incidents matter for Europe
The two cases involve different targets: a senior national politician and a company connected to major transport infrastructure. Together, they illustrate the range of risks facing European governments, public figures and strategic projects.
Personal-data exposure can create risks beyond the immediate theft. It may facilitate harassment, fraud, impersonation or further attempts to compromise the victim’s accounts. When relatives are also targeted, the potential impact extends beyond government systems and into private life.
The Brenner project presents a different security challenge. Rail infrastructure companies hold commercially sensitive information and operate systems connected to construction, logistics and communications networks. A breach does not automatically mean that trains, tunnels or safety systems have been disrupted, but it can still affect confidentiality and operational resilience.
The incident is also cross-border in nature. The tunnel project spans Austria and Italy, meaning that cyber resilience is relevant to both countries and to the wider European transport network. It highlights why cybersecurity cooperation and information-sharing remain important for infrastructure projects operating across national borders.
What happens next?
For the tunnel company, the immediate priority is to complete the forensic investigation, determine which data were accessed and assess whether further protective measures are required. The company may also need to notify relevant authorities or affected parties, depending on the nature of the data and the applicable legal obligations.
For Tajani’s case, Italian authorities would need to establish how the information was obtained, who was responsible and whether the activity formed part of a broader campaign. Public attribution can have diplomatic and security implications, so governments generally distinguish between an initial suspicion and a formally supported finding.
The incidents also reinforce several practical priorities for organisations and public officials:
- Rapid isolation of compromised systems;
- Protection of personal and family information;
- Independent technical investigation;
- Coordination with national cybersecurity and law-enforcement bodies; and
- Clear communication about confirmed impacts and remaining risks.
What does this mean for Italy and Austria?
There is no information indicating that the Brenner Base Tunnel’s construction has been halted or that transport services have been disrupted. The confirmed impact currently concerns the theft of non-public data and the company’s response to the network intrusion.
For Italy, the targeting of the foreign minister comes amid sensitive European security debates connected to Russia and Ukraine. For Austria, the breach highlights the importance of protecting a major infrastructure project with international significance. Any wider consequences will depend on the findings of the ongoing investigations.
Conclusion
These cyberattacks show how European security threats can affect both political leaders and infrastructure companies. The targeting of Antonio Tajani remains under investigation, while BBT SE has confirmed that non-public data were stolen from its internet-connected network. The key next step is verified attribution and a clear assessment of whether additional systems, individuals or organisations were exposed.