Italian prosecutors confirm journalist hacked with Paragon spyware

The public prosecutors’ offices in Rome and Naples, which are investigating the spyware scandal in Italy, have officially confirmed that journalist Francesco Cancellato was hacked with spyware. According to a press release from the prosecutors, a technical report concluded that the phones of Cancellato, the director of the news website Fanpage, and immigration activists Giuseppe Caccia and Luca Casarini all showed traces of spyware infection on December 14, 2024. The technical report stated, “The execution of three consecutive attacks on the same night suggests that they may have been part of the same infection campaign,” marking the first independent confirmation of the hack. Cancellato and around 90 other people, including journalists and civil society members, had previously been alerted by WhatsApp in January 2025 that they were targeted with spyware developed by Paragon Solutions, an Israeli-based company owned by American private equity firm AE Industrial.

The new findings introduce a complex legal contradiction. Italian judicial authorities previously inspected the Paragon spyware server used by AISI, the Italian intelligence agency, to target its surveillance subjects. While those authorities found evidence of operations against Caccia and Casarini, they found no evidence of an operation against Cancellato. Furthermore, by June 2025, an investigation by COPASIR, the Italian Parliamentary Committee for the Security of the Republic, concluded that Italian intelligence agencies had lawfully targeted the two activists but found no evidence of a hack against Cancellato. The Italian government, led by Prime Minister Giorgia Meloni, has denied being behind the hack on Cancellato. In response to the spyware scandal, Paragon, whose spyware is called Graphite, canceled its contracts with its Italian government customers.

The development highlights a broader spyware scandal spreading across Europe. John Scott-Railton, a researcher at Citizen Lab, noted that the confirmation raises serious questions regarding why previous official investigations by Italian authorities failed to surface any confirmation of the hack. Other alleged targets have also pointed out discrepancies; Ciro Pellegrino, a Fanpage journalist who was alerted of a suspected attack by Apple, was not found to have spyware traces in the prosecutors’ technical report, despite Citizen Lab concluding he was hacked with Paragon spyware. The situation mirrors similar spyware scandals in Greece, Hungary, Poland, and Spain. Recently, a Greek court sentenced Tal Dilian and three other executives of the spyware maker Intellexa to eight years in prison for illegal wiretapping and privacy violations, concluding a case linked to the “Greek Watergate” scandal.

Why it matters

This confirmation validates long-standing concerns about the use of commercial spyware against civil society in Europe, forcing a reckoning for both the vendors and the government agencies that deploy them.