Cyber Incident Victim: Milano, Italy
Date:
Dec 2024
Location:
Italy
Summary
A pro-Russian hacker group known as Noname057(16) claimed responsibility for a distributed denial-of-service (DDoS) attack targeting Italy's Foreign Ministry and Milan's airports, temporarily disrupting around ten official websites. The cyber incident, which flooded networks with excessive traffic to paralyze systems, was mitigated within two hours by national cybersecurity responders, causing no flight disruptions at the affected airports; while websites were inaccessible, mobile applications remained operational throughout the outage.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On December 28, 2024, approximately ten official Italian websites experienced cyber attacks, including those of the Foreign Ministry and Milan’s Linate and Malpensa airports. The pro-Russian hacker group Noname057(16) claimed responsibility for the incident through a Telegram post, framing it as retaliation against Italian "Russophobes." Italy’s national cybersecurity agency confirmed the attacks involved Distributed Denial of Service (DDoS) techniques, where threat actors overwhelm networks with excessive data traffic to disable them. The agency’s spokesperson stated the group’s involvement was plausible based on available evidence. Targeted websites became temporarily inaccessible during the attack, though the cybersecurity agency provided rapid assistance to affected institutions and private entities. Mitigation efforts contained the disruption within two hours, restoring normal operations without prolonged downtime.
SEA, the company managing Milan’s airports, confirmed the attack caused no operational disruptions to flights at Linate or Malpensa. While airport websites were rendered inoperative during the incident, mobile applications maintained functionality, allowing passengers to access flight information and services. The cybersecurity agency emphasized no data breaches or system compromises occurred beyond the temporary DDoS-induced outages. No additional targets beyond the initially reported ten websites were disclosed in available reports. The incident concluded with services fully restored and no further claims or escalations from Noname057(16) documented in the immediate aftermath.