Banks and insurance companies under attack: hackers are using email
The ACN recorded 168 incidents in the first nine months of 2026. Quacivi in Parliament: cybercrime is the predominant threat in the banking sector, whilst hacktivism is the main concern in the insurance sector. One in five breaches is linked to third-party products or services. Artificial intelligence makes attacks more credible and targeted
Key points
Banks are the main target of cybercrime. Hacktivist groups are the predominant threat to insurance companies. In the first nine months of 2026, CSIRT Italia recorded 168 incidents across the two sectors, 47 of which were classified as incidents – that is, with a confirmed impact. These figures were presented by Quacivi, Director-General of the National Cybersecurity Agency (ACN), to the Commission of Inquiry into the Italian banking system.
Banks and insurance companies: the figures behind the cyber threat
The banking sector accounted for 137 incidents and 44 breaches; the insurance sector, 31 and three respectively. The threat landscape is also changing. In the banking sector, 64 per cent of incidents are attributed to cybercrime, 32 per cent to hacktivist groups and 4 per cent to internal actors. In the insurance sector, hacktivist activity accounts for 83 per cent, with incidents consisting almost entirely of DDoS attacks and a confirmed impact in fewer than one in ten cases.
Geopolitical tensions are fuelling these campaigns, but their impact has generally been limited thanks to the mitigation measures taken by operators and the alerts issued by CSIRT Italia.
Then there is the issue of technical failures. “The main cause of incidents, however, turned out to be non-cyber in nature,” explains Quacivi: twelve of the 47 incidents were caused by technical failures, all in the banking sector. The incident tally therefore also includes operational malfunctions.
Email, stolen credentials and ransomware
“Email remains the primary means of access in both sectors,” emphasises the director of ACN. Compromised corporate email accounts and stolen credentials remain key points of entry. Added to these is the exploitation of vulnerabilities, particularly in perimeter security systems.
