Uffizi under hacker blackmail, works in vaults and doors bricked up

A ransom demanded by hackers. The Medici grand ducal treasure rushed into the Florentine vault of the Banca d'Italia. Doors walled up for greater defence. And maximum confidentiality demanded of the staff. The Uffizi Galleries, one of the world's largest and most famous treasure troves of artistic heritage, are in the trenches to fend off the consequences of the cyber attack of last February, a raid that thoroughly penetrated the defences of Italy's most important museum and may have been preceded by a more devious incursion in the summer of 2025. There is also talk of the theft of passwords and the security plan, but the museum denies such decisive consequences.

If anything, the Uffizi, due to the effects of the computer blitz, is facing the demand for the payment of a sum - a request from the hackers that would have arrived directly on the mobile phone of director Simone Verde - in order not to sell sensitive data on the darkweb, to anyone, that would be stolen. But so far, says the great museum, largely dismantling the reconstruction that has emerged on the affair, "no damage has been done nor has any theft been carried out" and "there is no evidence of any kind regarding the hackers' possession of security maps".

The weak point exploited by the hackers to gain access to the sensitive data stored on the servers would be a programme accessible from the institutional site, i.e. software that manages the flow of low-resolution images and from which the hackers would trace back - like a 'gang of the hole' that enters banks and jewellery stores from the sewers to rob them, in this case in digital ecosystems - to the servers of the Galleries with the databases.

The Public Prosecutor's Office, together with the Postal Police and the National Cybersecurity Agency, has been investigating for weeks for the crimes of attempted extortion (ransomware) and abusive access to computer systems. Acn experts have also arrived in Florence in recent months: a team has been working with the museum's IT technicians to identify how the hackers got in, to clean up the servers and secure the computer systems. The investigation was started with a file against unknown persons and, among the objectives, it is to establish where the perpetrators came from, whether they were based abroad and in which geographical area.

Because of the breach, the great Florentine pole - which extends from the Galleries to the Vasari Corridor, Palazzo Pitti and the Boboli Gardens - has slowly and discreetly turned into a besieged "fortress". The Uffizi also explain that the transfer of the "Medici treasure" to Bankitalia's basement is due to the "building site whose tender was launched in September" - thus not due to the cyber attack - and emphasise that the pieces of the grand ducal collection "had to be cleared out in any case in view of the start of the work", while "the first phone calls on the matter took place between the Uffizi and Banca d'Italia in the autumn".