Cyber Incident Victim: IlGiornale
Date:
Apr 2018
Location:
Italy
Summary
Hackers breached the website of IlGiornale, publishing a fabricated news alert falsely announcing the imprisonment of Silvio Berlusconi and claiming the hacker group AnonPlus provided evidence to magistrates. The attackers mimicked the publication's formatting style and additionally deleted a legitimate article by the deputy director criticizing political figures linked to Berlusconi. Technical staff swiftly intervened, removing the false alert and expelling the intruders from the compromised system.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 22, 2018, at approximately 6:39 AM, unidentified hackers infiltrated the website of Italian newspaper IlGiornale.it. The attackers gained unauthorized access to the publication's content management system and published a fabricated breaking news alert mimicking the outlet's standard formatting. The false bulletin declared "Berlusconi in galera. AnonPlus fornisce prove alla magistratura" ("Berlusconi jailed. AnonPlus provides evidence to magistrates"), accompanied by a link to the hackers' social network platform. Simultaneously, the intruders deleted an article authored by deputy editor Francesco Maria Del Vigo that had been prominently featured on the homepage. The removed piece criticized certain political figures described as "furbetti del male assoluto" ("sly operators of absolute evil") who allegedly maintained business ties with former Prime Minister Silvio Berlusconi while publicly opposing him.
IlGiornale's editorial and technical teams detected the intrusion shortly after it occurred. Staff promptly removed the fraudulent news alert and restored the deleted article through direct intervention in the compromised systems. Technical personnel successfully expelled the attackers from the portal, terminating unauthorized access. The hackers claimed affiliation with "AnonPlus," a group self-identified as having previously leaked emails belonging to politician Matteo Salvini. Their actions combined disinformation through fabricated content with targeted suppression of existing material they deemed objectionable. The incident caused temporary disruption to normal publishing operations but did not result in prolonged website downtime. No additional compromised systems or data exfiltration beyond the content manipulation were reported in the available account.