Olympic Cyber Frontlines: Why Italy’s Risk Calculations May Be Fatally Flawed

Picture this: It’s February 2026. The world’s eyes are on Milan and Cortina, where the Winter Olympics unfold. Behind the scenes, a different contest rages-a surge of cyberattacks targeting Italy’s digital infrastructure. Government reports tally the numbers, but are they telling the whole story? Security insiders say the real risks, fueled by geopolitical tensions and sophisticated cybercrime, are far more severe than the official narrative admits.

Fast Facts

• Cyber incidents in Italy nearly doubled between January and February 2026, coinciding with new NIS2 obligations and Olympic preparations.
• ACN reported a modest impact from DDoS attacks, but experts fear this underestimates the broader risk.
• Clusit data reveals a 42% rise in cyber incidents in Italy in 2025, with most global attacks rated as high severity.
• Technological, manufacturing, and local government sectors are prime targets for ransomware, phishing, and DDoS attacks.
• Critical vulnerabilities in widely-used software-such as Fortinet and SolarWinds-remain exposed, with active exploitation observed.

Unpacking Italy’s Cyber Risk Blind Spots

The Italian National Cybersecurity Agency (ACN) recently published its monthly operational summary, painting a picture of rising cyber events-436 in February, up 94% from January. The surge, officials say, is largely due to broader NIS2 reporting obligations and the Olympic spotlight. However, security analyst Pierluigi Paganini warns that this narrative may lull organizations and the public into a false sense of security.

“There’s too much optimism,” Paganini argues. By focusing on the quantity of low-impact DDoS attacks and the expansion of reporting, the ACN risks obscuring the underlying vulnerabilities and the sophisticated threats Italy faces. The Olympics, a magnet for hacktivists and state-backed actors, have already triggered coordinated DDoS campaigns-some traced to pro-Russian groups-targeting hospitality, public administration, and transport sectors. While most disruptions were brief, experts fear this is just the visible tip of a much larger iceberg.

Comparative data from Clusit’s 2026 report is even more sobering: In 2025, cyber incidents in Italy jumped 42%, accounting for nearly 10% of incidents worldwide. Globally, 89% of attacks are driven by cybercrime, with a staggering 84% rated as high or critical severity. Yet, in Italy, over half of incidents are classified as medium or low, suggesting chronic underreporting or a focus on less severe-yet more frequent-attacks.

The most targeted sectors remain technology, local government, and manufacturing. Attackers exploit valid credentials, unpatched remote access, and phishing with alarming regularity. Ransomware continues to devastate these sectors, often leveraging the same technical weaknesses. Meanwhile, the volume of new vulnerabilities remains high-over 4,800 were published in February alone, with several already being actively exploited in the wild.

Despite a proactive monitoring push-over 4,650 alerts sent to public and private entities in February-the ACN’s operational focus may miss the forest for the trees. Paganini and other experts urge a broader view, one that integrates geopolitical risk, the evolving tactics of cybercriminals, and the looming threat to operational technology (OT) systems. Only by acknowledging these realities can Italy hope to protect its critical infrastructure and Olympic ambitions.

Conclusion: Rethinking the Narrative Before It’s Too Late

Italy’s cyber defense apparatus is working overtime-but the story told by official metrics may be dangerously incomplete. With the Winter Olympics and NIS2 regulations converging under a volatile geopolitical climate, underestimating the threat could have dire consequences. Experts call for a more candid assessment, one that empowers organizations and citizens alike to grasp the true scale of the cyber battlefield ahead.

WIKICROOK

• NIS2: NIS2 is an EU directive that enhances cybersecurity and protects critical infrastructure by imposing stricter requirements on essential and important entities.
• DDoS (Distributed Denial of Service): A DDoS attack overwhelms a website or service with excessive traffic, disrupting normal operations and making it unavailable to real users.
• Ransomware: Ransomware is malicious software that encrypts or locks data, demanding payment from victims to restore access to their files or systems.
• Operational Technology (OT): Operational Technology (OT) includes computer systems that control industrial equipment and processes, often making them more vulnerable than traditional IT systems.
• CVE (Common Vulnerabilities and Exposures): A CVE is a unique public identifier for a specific security vulnerability, enabling consistent tracking and discussion across the cybersecurity industry.