Italy's Foreign Minister Is on a Dark Web Bounty List of 18, and Rome Is Calling It Hybrid War

Italy's foreign minister spent the weekend watching his own name traded on the internet. Antonio Tajani says cybercriminals have been publishing his personal data on the dark web for days and are now offering money to anyone who can add to the file. The page carrying it calls itself a tribunal, and it lists eighteen people it describes as citizens hostile to the Russian Federation.

Italy's Foreign Minister Is on a Dark Web Bounty List of 18, and Rome Is Calling It Hybrid War

Rome, Italy — Tajani, who is also deputy prime minister, disclosed the leak himself on Saturday. By Sunday morning the story had stopped being a cybersecurity item and become a harder question: how does a European government protect the people who write its foreign policy when the attack is aimed at them personally, and the price is set in public?

What Tajani Said on Saturday

In a post on X, Tajani said the material had been circulating for days. "For days, cybercriminals have been spreading my personal data on the dark web and seeking other information, in fact exposing me and my family to new threats and intimidation," he wrote, adding that the criminals "are prepared to pay for other details on me and my loved ones."

His conclusion was blunt. "I will not allow myself to be intimidated in any way," he said, promising to keep working "to defend my ministry, and Italy" and to strengthen cooperation with allies. He then gave the leak a motive. Italy's "position on Ukraine is the political reason I have been targeted: defending the freedom of a sovereign state, taking a clear stand in support of a nation's democracy and independence, is dangerous in the eyes of these criminal entities."

A "Tribunal" Page, and Eighteen Names

The Italian daily Il Fatto Quotidiano reported the case first. Screenshots seen by Reuters showed Tajani's photograph inside a list of eighteen "citizens hostile to the Russian Federation." The material sat in a section of the dark web accessible through the Tor network, found during monitoring by cybersecurity authorities, according to a person close to the minister who said further checks were under way.

The group behind it, Italian outlets reported, is NoName057(16), a pro-Russian collective described in the Italian press as close to Russian military intelligence, the GRU. Corriere della Sera reported that the page is filed under a heading translating as "court for those who deserve a public verdict." Firstonline, which examined the page, reported that it has been online since the end of October. Since 26 October, according to Il Fatto's account, the group has been offering payment for passwords, addresses and personal details — thirteen days of an open bounty as of Sunday.

Four Italians on the List

The dossiers are not thin. Italian outlets described profiles carrying names, photographs, private telephone numbers, email addresses and the street addresses of homes, alongside curricula and other public material.

Four of the eighteen are Italian. Alongside Tajani are Francesco Lo Voi, the chief prosecutor of Rome; Ivano Gabrielli, who heads the Postal Police, Italy's communications police force; and Paolo Tassan-Zanin, the mayor of Aviano, a small town in Friuli that hosts a United States Air Force base.

Tassan-Zanin sounded genuinely puzzled. "I am surprised that my name appeared in this list," he said, "also because I am simply the mayor of a small town that hosts the US Air Force base, but I have no kind of influence over what happens inside it." That is the point of a list like this: it does not require the target to matter, only to be visible.

Who NoName057(16) Is, and Why These Names

There is a thread running through the Italian four. Last summer, Lo Voi and Gabrielli took part in Operation Eastwood, an investigation coordinated by Europol and Eurojust against NoName057(16). That operation produced five international arrest warrants against Russian citizens and the takedown of more than six hundred servers across several countries, according to Firstonline.

The list is not only Italian. Italian reporting names Michael Schmid, president of Eurojust; Benjamin Krause, a prosecutor in Frankfurt; Holger Münch, who heads Germany's federal criminal police; and Amaury-Jacques Garçon, a cybersecurity adviser to France's defence ministry. Sky TG24 also listed Michael Alexander Martens, an investigative journalist wanted by Moscow.

Prosecutors, cyber officials, a mayor, a journalist. Read together, the eighteen names sketch the machinery Europe has built against Russian hacking — which is what makes the publication of their home addresses look less like vandalism and more like reconnaissance.

Meloni's Answer, and Her Second Complaint

Prime Minister Giorgia Meloni issued a statement expressing solidarity with Tajani "following the revelations about the activities of pro-Russian hackers, and the publication on the dark web of personal data." Selling confidential information about officials, she said, is "a matter of grave concern that must be addressed with the utmost determination."

She did not stop there. Meloni also raised what she called the circulation of "false images," saying they had been shared by members of Italy's opposition, and warning that freedom of expression "can never become terrain for disinformation." That second complaint landed awkwardly: within a day the argument about a foreign hacking campaign had folded into an ordinary domestic fight about who was weaponising it.

Solidarity came from across the spectrum anyway. Elly Schlein, leader of the centre-left Democratic Party, condemned the targeting, and Senate president Ignazio La Russa called the episodes "extremely serious," saying they "cannot be underestimated and deserve firm condemnation."

The Regulator's Warning, and the Ministry's Account

One body intervened that few outsiders would have predicted: Italy's data protection authority. The Garante warned media outlets, websites and platforms that obtaining, disseminating or republishing data that comes from illicit activity is itself a breach of data protection law, even when the person concerned is a public figure.

That is a genuinely difficult instruction in a case like this, because the leak is the story. Outlets can report that a list exists, count it, and quote the ministers without republishing the phone numbers and home addresses that make it dangerous. The regulator's intervention sets the boundary early, before the material migrates from the dark web onto ordinary social feeds.

The Farnesina, Italy's foreign ministry, issued its own statement, confirming that cybersecurity structures had identified the spread of the minister's personal data in recent days in a Tor-accessible area, and expressing solidarity with Lo Voi, Gabrielli and Tassan-Zanin.

The Wider Campaign Europe Is Counting

Tajani's leak is being read in Rome as one data point in a much wider campaign. Over recent days Europe has absorbed a wave of hoax bomb threats that forced flight diversions, security alerts against broadcasters, cyberattacks on the refrigeration systems of thousands of supermarkets, and drone incursions. Al Jazeera reported separately on hacked warning alerts that briefly suggested nuclear radiation in Russia and Ukraine.

The Italian press noted one mercy: after dozens of incidents in preceding days, Saturday passed without a new onboard bomb threat. Investigators are still asking whether a single hand is behind it. The Paris prosecutor's office has opened a file to test a possible link to "foreign powers," the Financial Times reported that European intelligence agencies have launched a joint investigation into whether the hoax wave is tied to activists close to Vladimir Putin, and Europol is due to meet on the subject in the coming days.

Rome Asks the G7. Paris Has Not Agreed.

Tajani has taken the fight to the diplomatic calendar. He asked the French presidency of the G7 to put hybrid threats and cyberattacks on critical infrastructure at the centre of the foreign ministers' meeting in Paris on 9 and 10 November, a request Reuters reported was made in a letter to his French counterpart, Jean-Noël Barrot.

"We are facing a hybrid war, which is why I asked the G7 meeting in Paris on Monday to place this topic at the centre of our debate," Tajani said in a video message, adding an appeal to Italian politics: "Let us defend democracy, freedom, and prevent hybrid warfare from bringing us to our knees."

There is a catch worth stating plainly. France has published its agenda for the meeting — support for Ukraine, crises in the Middle East, maritime and port security, the effectiveness of humanitarian aid and the security of artificial intelligence — and it does not explicitly list hybrid threats or attacks on critical infrastructure. Italy has asked. Paris has not publicly agreed.

What Is Not Established

Three things should be held apart from the noise. First, there has been no public technical attribution. The Farnesina's statement names no authors; the Associated Press noted that Tajani himself did not indicate who might be responsible. Meloni blamed pro-Russian hackers, and Italian reporting points at NoName057(16), but a named suspect in a newspaper is not the same thing as an attribution on the record.

Second, nobody has said where the data came from. The ministry's statement does not describe the material, and does not say whether the Farnesina's own systems were breached — so the origin of the information remains unknown.

Third, Moscow's position. The Kremlin has not commented on the case, and Russia has consistently denied involvement in cyberattacks abroad. Russia's embassy in Italy did respond, sarcastically: "We have heard that drugs are sold on the dark web. So let us stay away. How Tajani got there, you will have to ask the people who hang around there."

Italy Has Been Here Before

None of this is new to Rome. In February 2025, Italian banks and transport companies were hit in what the hackers framed as a response to President Sergio Mattarella, whom they called Russophobe. In February 2026 came a wave against sites connected to the Milan-Cortina Winter Olympics, then a renewed targeting of Tajani on the group's Telegram channel, and last month an attack on the Farnesina's own website.

What has changed is the target. Hacking a ministry's website is an inconvenience that gets patched. Publishing a minister's home address, his family's details and an open purse for more is a threat that follows a person home, and it is cheaper to run than a missile.

Tajani says the foreign ministry has already built a cyber directorate, in place since 1 January, to defend against exactly this. The next tests come quickly: the G7 in Paris on Monday and Tuesday, Europol's meeting, and whatever the Italian investigation produces.

Watch the agenda, not the outrage. If hybrid threats make it onto the G7's published programme, eighteen names turned into a coordinated European response. If they do not, then a minister of a founding member of the European Union was priced on the dark web, and the answer was a press release.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: Associated Press; Reuters via The Hindu; Al Jazeera and AFP; Italy's Ministry of Foreign Affairs (Farnesina); Corriere della Sera; Sky TG24; Il Fatto Quotidiano via WION; Firstonline; NHK World; DiariodelWeb. Cover: Global 1 News editorial image. Photographs: Eduardo Munoz/Reuters via Al Jazeera; C.Berlin/Wikimedia Commons (CC0); AFP via Al Jazeera.