Italian judicial authorities have officially confirmed that journalist Francesco Cancellato was the victim of a targeted spyware attack. The revelation follows a technical investigation into a broader surveillance scandal involving the Israeli-developed Paragon “Graphite” spyware.
Evidence of a Coordinated Campaign
Public prosecutors in Rome and Naples disclosed that a technical report analyzed the devices of Cancellato, director of the news outlet Fanpage, as well as those of immigration activists Giuseppe Caccia and Luca Casarini. The analysis identified clear traces of spyware infection occurring in the early hours of December 14, 2024.
According to the official press release, the timing of the three infections suggests a single, coordinated campaign. While authorities were able to link the targeting of Caccia and Casarini to operations conducted by the Italian intelligence agency AISI, the source of the attack on Cancellato remains unidentified.
The Paragon Spyware Controversy
This confirmation marks a significant development in a case that began in January 2025, when WhatsApp alerted roughly 90 individuals—including journalists and civil society members—that they had been targeted by Paragon Solutions. The Israeli firm, now owned by the American private equity company AE Industrial, provides the “Graphite” surveillance tool.
The Italian government, led by Prime Minister Giorgia Meloni, has consistently denied involvement in the hack targeting Cancellato. In a recent statement, the journalist demanded clarity, accusing the government of maintaining silence or providing misinformation regarding the surveillance of its citizens.
Discrepancies in Official Investigations
The findings have sparked confusion among other alleged victims. While the prosecutor’s report did not find evidence of spyware on the phone of Fanpage journalist Ciro Pellegrino, independent researchers at Citizen Lab had previously concluded that Pellegrino’s device was indeed compromised by Paragon software—a claim supported by an earlier security alert from Apple.
“How is it possible that Citizen Lab, an authority on spyware, found evidence that Paragon’s Graphite was on my phone, while the Italian prosecutors’ experts did not?” Pellegrino questioned. The discrepancy has led experts, including John Scott-Railton of Citizen Lab, to raise alarms regarding the transparency and thoroughness of previous official inquiries into the matter.
A Growing European Crisis
The Italian investigation is part of a larger trend of spyware abuse across Europe, with similar scandals emerging in Greece, Hungary, Poland, and Spain. In a landmark move last month, a Greek court sentenced executives from the firm Intellexa to eight years in prison for their role in the “Greek Watergate” scandal, which involved the illegal surveillance of high-profile political and military figures.
Following the international outcry and the exposure of its clients, Paragon reportedly canceled its contracts with the Italian government. Prosecutors in Rome and Naples have pledged to continue their investigation to identify the unknown actors responsible for the hack on Cancellato.