Italian prosecutors have confirmed that journalist Francesco Cancellato, director of the news website Fanpage, was hacked with spyware after an independent technical investigation concluded his phone showed traces of infection. The finding, announced Thursday by the public prosecutors’ offices in Rome and Naples, also confirmed infections on the phones of immigration activists Giuseppe Caccia and Luca Casarini.
The technical report determined that all three phones were compromised in the “early hours” of December 14, 2024. “The execution of three consecutive attacks on the same night suggests that they may have been part of the same infection campaign,” the report stated. The full document has not been made public.
What the investigation found
This marks the first independent confirmation that Cancellato was hacked. In January 2025, he was among roughly 90 people, including journalists and civil society members, who received alerts from WhatsApp warning they had been targeted with spyware made by Paragon Solutions, an Israeli company now owned by American private equity firm AE Industrial.
Italian judicial authorities also inspected the Paragon spyware server operated by the domestic intelligence agency AISI. While they found evidence of operations targeting Caccia and Casarini on that server, they found no trace of an operation against Cancellato. Who ordered or carried out the hack on Cancellato remains unknown.
A separate investigation by the Italian Parliamentary Committee for the Security of the Republic, known as COPASIR, concluded by June 2025 that intelligence agencies had lawfully targeted Caccia and Casarini. That inquiry also found no evidence of a hack against Cancellato. The prosecutors’ offices said they will continue investigating to identify his attackers.
Government denials and unanswered questions
The Italian government, led by Prime Minister Giorgia Meloni, has denied involvement in the Cancellato hack. At a press conference in January, Meloni said only that her government “is offering all its assistance and all the answers it can provide to help clarify this issue.” It did not respond to a request for comment ahead of Thursday’s announcement.
Cancellato remains unsatisfied. “We are asking for clarity,” he wrote on Thursday. “And we have not received it from the government, which has remained silent whenever possible for a year. And when it didn’t remain silent, it told lies.”
John Scott-Railton, a researcher at Citizen Lab who investigated the Paragon cases in Italy, said the confirmation “raises serious questions about why no confirmation was surfaced in prior official investigations by the Italian authorities.”
A disputed finding on other alleged victims
The technical report introduced a new complication. It found spyware evidence only on the phones of Caccia, Casarini, and Cancellato, but not on the devices of four other alleged victims, including Ciro Pellegrino, a Fanpage colleague of Cancellato’s. Citizen Lab had previously concluded Pellegrino was hacked with Paragon’s spyware, known as Graphite, and Apple had separately sent him a warning alert.
“How is it possible that Citizen Lab, an authority on spyware, found evidence that Paragon’s Graphite was on my phone, while the Italian prosecutors’ experts did not?” Pellegrino said. “And why would Apple send me the alerts? For fun?”
Paragon canceled its contracts with Italian government customers following the scandal. The prosecutors’ offices in Rome and Naples did not respond to a request for comment.
Photo by Josè Maria Sava on Unsplash
This article is a curated summary based on third-party sources. Source: Read the original article
