Italian Foreign Minister Tajani Says Hackers Posted His Personal Data on Dark Web; Brenner Tunnel Company Confirms Separate Breach

Italy's foreign minister says his family is now a target.

Antonio Tajani, who is also deputy prime minister, wrote on X on Saturday, Nov. 7, that "for days now, cybercriminals have been publishing my personal data on the dark web and seeking further information, effectively exposing me to new threats and intimidation." He added that the hackers are "willing to pay for more details about me and my loved ones."

"My response is very simple: I will not be intimidated in any way," he wrote.

What Tajani and Meloni have said

Tajani did not say what data was exposed. He did suggest the problem is ongoing, and said the ministry is treating it seriously and coordinating with allied countries.

He tied the campaign to Rome's backing of Kyiv. "Our position on Ukraine is the political reason why I have been targeted," he said. Defending a sovereign state's freedom, in his words, is "dangerous in the eyes of these criminal entities." He also floated a second possible trigger: the government's push to harden the Foreign Ministry's digital defenses. Italy created a dedicated cybersecurity department inside the ministry on Jan. 1, 2026.

Prime Minister Giorgia Meloni expressed solidarity and blamed pro-Russian hackers. She called the attempted sale of confidential information about government officials "a matter of grave concern that must be addressed with the utmost determination."

Tajani did not name a group. Sky TG24 has attributed the activity to NoName057(16), a pro-Russian hacker collective. That attribution rests on Sky TG24's reporting alone, and no Italian authority has confirmed it. No arrests or charges have been announced.

A separate breach at the Brenner Base Tunnel

The same day brought news of a second, apparently unrelated incident. BBT SE, the company building the Brenner Base Tunnel, confirmed it was hit by a targeted cyberattack on Oct. 17.

The Austrian daily Tiroler Tageszeitung broke the story on Nov. 6. A company spokeswoman confirmed that unauthorized parties gained access to part of the data reachable through its internet-connected network.

BBT SE says it activated its security protocols, isolated the affected systems, brought in outside specialists for forensic analysis and notified the authorities. Its current assessment is that no operational processes were affected and construction continues.

The Brenner project is a 55 km rail link between Innsbruck, Austria, and Fortezza, Italy. The Austrian railway ÖBB owns half of BBT SE. The other half sits with an Italian holding company controlled 89.857% by RFI, Italy's state rail network operator. Austria's state protection agency, the DSN, is in contact with ÖBB.

Everest and the extortion model

The Tiroler Tageszeitung said early investigations point to Everest, a Russian-speaking group. It cited an analysis by U.S. cybersecurity firm ZeroFox linking Everest to an international cyber-extortion network. According to that analysis, the group steals sensitive data, threatens to publish it and demands payment.

One report says Everest has claimed the attack and threatens to release the stolen files. BBT SE has not confirmed that. The attackers' identity has not been verified.

The company has declined to say whether it has negotiated with the hackers or paid anything. It has also not said which data was taken or how far the intruders got into its network.

Part of a wider pattern, but no proven link

Both cases land amid a run of cyber and hoax incidents across Europe. Al Jazeera cited hoax bomb threats that forced flight diversions and security alerts at broadcasters, along with attacks on supermarket refrigeration systems.

No official has publicly connected the Tajani leak to the BBT breach or to those other incidents. Tajani's explanation for his own case is his own assessment of motive. It is not an investigative finding.

The established facts are straightforward. A sitting foreign minister of a G7 country says his personal data is being traded and his relatives are being sought. A major state-linked infrastructure builder lost data through an internet-facing system. In the BBT case, the entry point was something exposed to the public network.

BBT SE's forensic review is still under way, and Everest has reportedly threatened to publish what it took. In the Tajani case, the open question is what data is already out and whether Italian authorities will formally attribute the campaign to a named group.