Cyber Incident Victim: Referendum Cittadinanza
Date:
Apr 2025
Location:
Italy
Summary
The site referendumcittadinanza.it has been hit by a coordinated hacker campaign that generated millions of access attempts from masked IP addresses traced to locations such as China, Mexico, the Philippines, Bolivia, South Korea and Singapore. The traffic overload rendered the platform unavailable, displaying a maintenance notice while technicians work to restore service. Organizers have filed a complaint with prosecutors, describing the activity as a targeted and persistent disruption aimed at hindering the informational resource for the upcoming referendum.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The attack on the referendum website began inthe evening of April 25 2025, when a sustained flow of access attempts started targeting the domain referendumcittadinanza.it. By the morning of April 27 the site was no longer reachable, displaying a maintenance message that read “Stiamo effettuando la manutenzione. Ti preghiamo di controllare più tardi.” The promotive committee reported that during the previous day, Sunday April 27, they had logged approximately twenty‑one million access requests originating from IP addresses masked to appear as if they came from China, Mexico, the Philippines, Bolivia, South Korea, and Singapore, although they noted the true source could be elsewhere. Technical staff were actively working to restore the service and bring the informational platform back online for voters preparing for the June 8‑9 referendum.
The committee described the traffic volume as having overloaded the site, preventing citizens from accessing details about the upcoming vote. They characterized the incident as an attack that, based on its continuous and constant nature from the evening of April 25, appeared to be targeted. In response, the committee announced it was gathering evidence to file a formal complaint with the public prosecutor’s office. Riccardo Magi, secretary of +Europa and president of the promotive committee, publicly stated that the scale of the assault demonstrated that the referendum and democracy itself were perceived as threatening, and he urged all Italians to participate in the vote on June 8 and 9.
The referendum scheduled for June 8‑9 2025 includes five constitutional questions that have passed the Constitutional Court’s admissibility test. The citizenship question seeks to halve the required legal residence period for non‑EU foreigners from ten to five years before they may apply for Italian citizenship. The remaining questions, promoted by the CGIL, concern the repeal of certain provisions on temporary work contracts, severance indemnities, and workplace safety regulations. No further details about the attackers’ identity, methods, or potential consequences beyond those reported in the source material are available.