Hackers are targeting infrastructure: here’s how essential services are protecting themselves
In Italia, there were 3,271 cyber incidents in nine months – more than the total for 2025. The Comtel report: from waterworks to hospitals, security depends on communications systems capable of withstanding emergencies
An aqueduct can be brought to a standstill without even touching a pipe. All it takes is access to the software that controls the pumps. An electricity grid can become vulnerable through the data that tells the control room what is happening. It is the paradox of connectivity: the more we know about our infrastructure, the more we must protect the tools we use to monitor it. Because a sensor that lies can be just as dangerous as a system that breaks down.
Cybersecurity has now reached this scale. This is explained in the Comtel Research Centre’s report on secure communications in critical infrastructure, which draws on input from institutions, businesses and universities, including Lumsa and the Scuola Superiore Sant’Anna. At the heart of this are hospitals, transport, energy and water: services whose complexity we are particularly reminded of when they cease to function.
The figures from Italy highlight the pressure: in the first nine months of 2026, the National Cybersecurity Agency recorded 3,271 cyber incidents, compared with 2,729 for the whole of 2025. There were 1,922 incidents with a confirmed impact. However, it is important to note that the increase is also partly due to the expansion of reporting obligations. Part of the phenomenon is becoming more visible simply because we are measuring it more effectively. It would be a mistake to confuse all these incidents with successful attacks.
The industrial problem remains. A drone inspecting a production line, a piece of hospital equipment, or a system controlling water distribution are all points where software meets reality. Compromising them means being able to transfer digital damage into the physical world. And to throw an operator off course, it may be enough simply to alter the information on which they must base their decisions.
The white paper refers to IBM’s ‘Cost of a Data Breach Report 2026’: a data breach costs an average of $4.99 million worldwide, rising to $6.6 million in the healthcare sector. These are average costs, not the cost of each individual attack. And no average figure on its own can capture the true cost of delayed medical assistance or the disruption of an essential service.
