Italian Prosecutors Confirm Journalist’s Phone Hacked with Paragon Spyware
In a significant development, Italian prosecutors have confirmed that journalist Francesco Cancellato’s phone was compromised using Paragon spyware. This revelation comes after a thorough technical analysis by the public prosecutors’ offices in Rome and Naples, which also identified similar infections on the devices of immigration activists Giuseppe Caccia and Luca Casarini. The attacks occurred in the early hours of December 14, 2024, suggesting a coordinated effort.
Background of the Spyware Attack
In January 2025, Cancellato, the director of the news website Fanpage, along with approximately 90 other individuals—including journalists and civil society members—received alerts from WhatsApp about potential spyware attacks. The spyware in question was developed by Paragon Solutions, an Israeli-based company that has since been acquired by American private equity firm AE Industrial.
Investigations and Findings
Italian judicial authorities conducted an inspection of the Paragon spyware server utilized by the intelligence agency AISI. While evidence of operations against Caccia and Casarini was found, no such evidence was discovered concerning Cancellato. This raises questions about the origin of the attack on Cancellato’s device, as it remains unclear who was responsible for the hack.
By June 2025, the Italian Parliamentary Committee for the Security of the Republic (COPASIR) concluded that the targeting of Caccia and Casarini by Italian intelligence agencies was lawful. However, the committee found no evidence indicating that Cancellato had been targeted by these agencies.
Government Response and Ongoing Investigations
The Italian government, led by Prime Minister Giorgia Meloni, has denied any involvement in the hacking of Cancellato’s phone. During a press conference in January, when questioned by Cancellato, Meloni stated that her government was offering all possible assistance to clarify the issue. Despite these assurances, the government has not provided further comments on the matter.
Cancellato has expressed frustration over the lack of transparency, stating, We are asking for clarity, and we have not received it from the government, which has remained silent whenever possible for a year. And when it didn’t remain silent, it told lies.
Broader Implications and International Context
This incident is part of a larger pattern of spyware misuse across Europe. Similar cases have emerged in countries like Greece, Hungary, Poland, and Spain. Notably, in Greece, executives of the spyware maker Intellexa were sentenced to prison for illegal wiretapping and privacy violations, highlighting the widespread concerns over the use of such surveillance tools.
Paragon’s Response and Ethical Considerations
In response to the scandal, Paragon Solutions terminated its contracts with Italian government customers. The company has emphasized its commitment to ethical practices, stating that it requires all users to agree to terms that explicitly prohibit the illicit targeting of journalists and other civil society figures. Paragon maintains a zero-tolerance policy against such targeting and has pledged to terminate relationships with any customer that violates these terms.
Conclusion
The confirmation of the spyware attack on journalist Francesco Cancellato underscores the pressing need for transparency and accountability in the use of surveillance technologies. As investigations continue, it is imperative to identify the perpetrators and implement measures to prevent future abuses, ensuring the protection of journalists and activists from unauthorized surveillance.
