Italian prosecutors confirm journalist was hacked with Paragon spyware

Italian prosecutors have confirmed that journalist Francesco Cancellato, who was warned via WhatsApp about a potential spyware intrusion last year, was indeed hacked. Authorities in Rome and Naples released a statement on Thursday detailing findings from a technical report that indicated Cancellato's phone, along with those of immigration activists Giuseppe Caccia and Luca Casarini, showed signs of spyware infection in the early hours of December 14, 2024. The report highlights that the simultaneous attacks on the three individuals suggest a coordinated campaign. This new information marks the first official acknowledgment that Cancellato, the director of the news outlet Fanpage, was targeted by spyware. In January 2025, Cancellato and approximately 90 others, including journalists and civil society members, received alerts from WhatsApp indicating they were potential targets of spyware developed by Paragon Solutions, an Israeli company now controlled by the American firm AE Industrial. Investigations into the spyware's usage by the Italian intelligence agency, AISI, revealed that while there was evidence of operations against Caccia and Casarini, authorities did not find proof of any operation targeting Cancellato. The identity of the hackers responsible for breaching Cancellato's device remains unknown. In a press conference, Italian Prime Minister Giorgia Meloni denied any government involvement in the hacking incident. Cancellato expressed frustration at the lack of clarity from the government over the past year, stating, "We are asking for clarity. And we have not received it from the government, which has remained silent whenever possible for a year." John Scott-Railton from Citizen Lab, who has been investigating the Paragon spyware cases, raised concerns about the lack of prior confirmation from Italian authorities regarding Cancellato's hack. Following the scandal, Paragon, whose spyware is known as Graphite, terminated its contracts with Italian government entities. In addition to Cancellato, Caccia, and Casarini, other figures in Italy, such as Ciro Pellegrino from Fanpage, were also warned of suspected attacks. Citizen Lab's findings confirmed that Pellegrino was indeed hacked with Paragon spyware, raising questions about the discrepancies between their findings and those of the Italian prosecutors. The report from the prosecutors indicated that only Caccia, Casarini, and Cancellato were found to have spyware on their devices, while Pellegrino and four other alleged victims were not included. Pellegrino voiced his confusion, questioning how different investigations could yield contrasting results regarding spyware presence on his phone. As Italy grapples with this latest spyware controversy, it joins a troubling trend of similar scandals across Europe, with recent incidents reported in Greece, Hungary, Poland, and Spain. The implications of these revelations continue to unfold, leaving many demanding accountability and transparency from their governments.