Italian Prosecutors Confirm Journalist Was Hacked With Paragon Spyware

In a shocking development that’s sending ripples through the tech and journalism communities, Italian authorities have confirmed that prominent journalist Francesco Cancellato was indeed hacked with sophisticated spyware last year. The revelation comes after months of speculation and denials from the Italian government.

The Technical Evidence That Broke the Case Wide Open

The public prosecutors’ offices in Rome and Naples dropped a bombshell on Thursday when they released their findings about the December 2024 spyware attacks. According to their technical report, Cancellato’s phone—along with those of immigration activists Giuseppe Caccia and Luca Casarini—showed clear traces of being infected with the notorious Paragon spyware during the early hours of December 14, 2024.

“The execution of three consecutive attacks on the same night suggests that they may have been part of the same infection campaign,” the technical report stated, according to the press release. This coordinated timing is particularly damning, suggesting a sophisticated operation rather than random targeting.

WhatsApp’s Early Warning That Proved Prophetic

Back in January 2025, WhatsApp had alerted Cancellato and approximately 90 other individuals—including journalists and civil society members—that they had been targeted with spyware developed by Paragon Solutions. At the time, many were skeptical about the claims, but this official confirmation validates those early warnings.

Paragon Solutions, the Israeli-based company behind the spyware (nicknamed “Graphite”), has been making headlines since American private equity giant AE Industrial acquired it in late 2024. The timing of these attacks, occurring just months after the acquisition, raises serious questions about the company’s new American ownership and their oversight of client operations.

The Government’s Shifting Narrative

What makes this case particularly explosive is the Italian government’s handling of it. The far-right administration led by Prime Minister Giorgia Meloni has consistently denied involvement in Cancellato’s hack, despite evidence suggesting otherwise.

During a January press conference, when Cancellato directly questioned Meloni about the attacks, her response was tepid at best: “My government is offering all its assistance and all the answers it can provide to help clarify this issue.”

That “assistance” apparently didn’t include honesty. Cancellato, who serves as director of the news website Fanpage, didn’t mince words in his response to the new findings: “We are asking for clarity. And we have not received it from the government, which has remained silent whenever possible for a year. And when it didn’t remain silent, it told lies.”

The Intelligence Agency Connection

The investigation revealed that Italian authorities had inspected the Paragon spyware server used by the intelligence agency AISI (Agenzia Informazioni e Sicurezza Interna). While they found evidence of operations against Caccia and Casarini, there was no record of an operation targeting Cancellato on the official server.

This absence of official documentation is particularly troubling. It suggests either that Cancellato was targeted by a rogue element within Italian intelligence, by a foreign actor using the same tools, or that the official records were deliberately altered or incomplete.

Citizen Lab Raises Serious Questions

John Scott-Railton, a senior researcher at Citizen Lab who investigated the Paragon cases in Italy, didn’t hold back his assessment of the situation. He noted that the new revelation about Cancellato’s hack “raises serious questions about why no confirmation was surfaced in prior official investigations by the Italian authorities.”

This discrepancy between official findings and technical reality points to potential incompetence, cover-ups, or both within the Italian investigative apparatus.

The Broader European Spyware Epidemic

Italy’s spyware scandal is far from isolated. The country is the latest European nation to be embroiled in such controversy, following similar cases in Greece, Hungary, Poland, and Spain.

The parallels with Greece’s “Watergate” scandal are particularly striking. Just last month, a Greek court sentenced Tal Dilian and three other executives of spyware maker Intellexa to eight years in prison for illegal wiretapping and privacy violations. That scandal involved the Greek government allegedly hacking the phones of politicians, journalists, businesspeople, and military officials using Intellexa’s Predator spyware.

Unanswered Questions and Ongoing Investigations

Despite the confirmation of Cancellato’s hack, many questions remain unanswered. Who exactly was behind the attack? Why did official investigations fail to identify it earlier? And most importantly, what does this mean for press freedom and privacy in Italy?

The prosecutors’ offices have stated they will continue investigating to identify Cancellato’s hackers, but given the track record so far, many are skeptical about whether the full truth will ever come to light.

The Corporate Angle: Paragon’s Damage Control

In response to the mounting scandal, Paragon took the unprecedented step of canceling its contracts with Italian government customers. This move, while potentially limiting further abuse of their technology, also conveniently distances the company from the controversy.

However, it’s worth noting that as of last year, Paragon maintained an active contract with U.S. Immigration and Customs Enforcement (ICE), raising concerns about the proliferation of these powerful surveillance tools to American law enforcement agencies.

Other Victims, Lingering Doubts

The scandal has affected numerous other individuals beyond the three whose infections were confirmed. Ciro Pellegrino, another Fanpage journalist who received an alert from Apple about a suspected attack on his iPhone, expressed frustration with the latest findings.

“I’m pretty disconcerted,” Pellegrino told TechCrunch. “How is it possible that Citizen Lab, an authority on spyware, found evidence that Paragon’s Graphite was on my phone, while the Italian prosecutors’ experts did not? And why would Apple send me the alerts? For fun?”

His skepticism highlights the ongoing inconsistencies in the investigation and the potential for many more victims whose cases may never be properly investigated or confirmed.

The Fight for Transparency Continues

As this story develops, one thing is clear: the battle for digital privacy and press freedom in Italy is far from over. The confirmation of Cancellato’s hack represents a small victory for transparency, but the broader questions about government surveillance, corporate responsibility, and the weaponization of technology against journalists remain largely unanswered.

For now, Italian journalists, activists, and concerned citizens are left wondering who might be next on the target list of those wielding these powerful digital surveillance tools.

Tags: #SpywareScandal #Italy #ParagonSolutions #PressFreedom #DigitalPrivacy #GraphiteSpyware #JournalismUnderThreat #GovernmentSurveillance #TechEthics #CyberSecurity #CitizenLab #WhatsAppSecurity #ItalianPolitics #AEIndustrial #FarRightGovernment #DataPrivacy #MobileSecurity #InvestigativeJournalism #TechNews #EuropeanPolitics

Viral Phrases: “The execution of three consecutive attacks on the same night” “My government is offering all its assistance and all the answers it can provide” “We are asking for clarity… when it didn’t remain silent, it told lies” “How is it possible that Citizen Lab… found evidence… while the Italian prosecutors’ experts did not?” “For fun?” “raises serious questions about why no confirmation was surfaced” “The fight for digital privacy and press freedom in Italy is far from over”

,