Cyberattacks: ‘Black October’ for Italian logistics – NoName targets MIT and businesses for two weeks

Orders cancelled. Shipments halted. Corporate portals out of action for hours, in some cases for days. The financial damage has yet to be assessed. In October, the cyber threat against Italia shifted gear: it moved beyond merely targeting websites and began to disrupt business operations. The target was logistics, a vital part of the country’s infrastructure. For over two weeks, between 7 and 21–22 October, transport, shipping and public platforms came under a series of DDoS attacks of an intensity and duration unprecedented in the sector. Analysts have already dubbed it the ‘Black October’ of Italian logistics.

The first blow came on 7 October. The target was the Public Contracts Hub, a platform linked to the Ministry of Infrastructure and Transport, operated under contract by Itaca – the Institute for Innovation, Transparency in Procurement and Environmental Compatibility – and hosted on the servers of the National Strategic Centre. The attack was attributed to NoName, a pro-Russian hacker collective already known for its disruptive campaigns against Western governments, institutions and infrastructure. The ministry later confirmed that the attack had been neutralised on the same day. Twenty-four hours later, the same group struck the Ministry of Foreign Affairs, following the attacks by Russian spokesperson Maria Zakharova against Antonio Tajani. This was yet another target in a wave of cyber pressure that was, at that time, spreading across Italian infrastructure, transport and public administrations.

The technique, at least on the surface, is straightforward. Millions of artificial access attempts are flooded onto systems at the same time, overwhelming them and rendering them inaccessible. The DDoS attack. But in October, the scale of the attacks went beyond a mere demonstration. After MIT, logistics companies came under fire. The digital disruption began to spill over into the physical supply chain. Orders slowed down. Communications were cut off. Shipments ground to a halt. This is where the qualitative leap becomes apparent: the cyber-attack no longer merely took a web page offline, but began to disrupt the functioning of businesses.

And the front has widened. Azimut Benetti Group, Neri Group, Confetra, the logistics association Alis, and the container operator Lorenzini & C. Different objectives, within the same supply chain. Claims of some attacks were made on Telegram channels, whilst specialists from the National Cybersecurity Agency monitored the wave day by day. Several of the organisations affected fall within the scope of NIS 2, the European regulation that imposes enhanced cybersecurity requirements on entities deemed essential to the functioning of the country. In some cases, the systems were back to full operation after 24 or 48 hours. In others, the effects lingered for longer.

Then the series of attacks began to intersect with politics. On 20 October, a new cyberattack also hit the Ministry of Defence’s website. Guido Crosetto spoke of a hybrid war, with an indirect reference to Russia.