“I stole the anti-Mafia files”. A hacker is selling them for Bitcoin

Investigations are currently underway into a possible cyberattack on the Anti-Mafia Investigation Directorate (DIA), the unit that brings together police officers, Carabinieri and finance police to investigate organised crime. According to LaPresse, numerous screenshots of the DIA website’s homepage – which is reported to have been hacked – are circulating on social media. According to the Corriere, the attack is described and claimed to be a ‘data leak’, i.e. a theft of data: it is not yet clear when it took place, what type of data is involved or what damage it has caused, and investigations are underway to identify those responsible. The claim comes from an account signing itself as "weykofa", which has put a 222-megabyte archive up for sale, claiming that the files originate from the DIA. The listing was reported on Saturday 8 November by Dark Web Informer, an account that monitors the dark web. To hand over the 302 files, the hacker is demanding payment in Bitcoin and Monero, two cryptocurrencies, the latter of which is very difficult to trace.

Nothing has been verified as yet. There has been no official confirmation from either the DIA or the Ministry of the Interior, and it is not possible to establish whether the files actually exist, whether they originate from the DIA’s systems, or whether they are public material pieced together to simulate a data leak. This is an important detail: those who sell stolen data have every interest in inflating the value of their goods, and it sometimes happens that files presented as confidential turn out to be documents that are already in the public domain.

The DIA was established in 1991, during the period of the Cosa Nostra massacres, at the behest of Giovanni Falcone alongside the National Anti-Mafia Prosecutor’s Office and the district anti-Mafia prosecutor’s offices. It is a joint-force body within the Department of Public Security, in which the Police, the Carabinieri, the Guardia di Finanza and the Prison Service work together, and investigates the mafia, including through the seizure and confiscation of assets. If data relating to its investigations had indeed been stolen, it would be one of the most serious attacks ever suffered by an Italian institution.

This is not the first time the DIA has come under fire. In early 2025, the pro-Russian hacker group NoName057(16) had included its website, alongside that of the National Magistrates’ Association, amongst the targets of a campaign of attacks; however, the sites remained accessible. But that was a different kind of attack – a so-called DDoS attack – which floods a website with requests until it becomes inaccessible, without stealing anything. The data breach claimed today is a different matter, and for the time being, there is nothing linking it to NoName057.

The incident comes at the end of a week of attacks against Italy: the attacks on supermarket freezers, claimed by two pro-Russian groups; the publication on the dark web of the personal data of Foreign Secretary Antonio Tajani, Rome’s Chief Prosecutor Francesco Lo Voi and the Director of the Postal Police Ivano Gabrielli; and the false bomb threats on flights. According to Corriere, it cannot be ruled out that the attack on the DIA is linked to the forthcoming summit of European police forces on the attacks of recent days. Tomorrow, at the Ministry of the Interior, the National Committee for Public Order and Security will meet, convened by Piantedosi specifically to address the cyber threat.