Italy ’s Parliament cyberattack highlights hybrid warfare risks and the need for transparency, stronger defenses and accountability.

The cyberattack targeting email accounts at Italy’s Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, raises questions that go well beyond the security of individual inboxes. At a time when European institutions face growing cyber pressure, the incident highlights how access to political communications can become part of a broader hybrid warfare strategy.

The Chamber confirmed that its IT systems had been targeted and said it had activated security measures in cooperation with Italy’s National Cybersecurity Agency (ACN). According to reports, three parliamentary email accounts were affected, including those associated with Meloni, former Justice undersecretary Andrea Delmastro and lawmaker Paolo Formentini.

Palazzo Chigi clarified that the account assigned to Meloni was not the one she uses for government communications. That distinction matters, but it does not settle the broader security questions raised by the incident. The public information available so far does not provide a complete technical account of what happened, what level of access the attackers may have obtained, or whether any information was taken.

The Chamber described the incident as having no emergency implications, adding that attacks of this kind occur daily. It also confirmed that similar attempts and pressure on IT systems had intensified in recent days, affecting other Italian, European and international institutions.

This combination of statements deserves closer scrutiny. Cyberattacks may be a daily occurrence, but their frequency does not make every incident routine or harmless. The significance of an attack depends on the target, the access obtained, the information exposed and the wider strategic context.

An email account is more than a channel for exchanging messages. It can reveal professional relationships, contacts, ongoing discussions, schedules and the way an institution operates. Depending on the level of access obtained, an attacker may also find documents, personal information or details that could help target other officials.

A compromised account can provide a starting point for further attacks. Messages sent from a legitimate address may appear trustworthy, making it easier to approach colleagues, political staff or external partners. Information gathered from correspondence can also support impersonation, targeted phishing or attempts to obtain access to other systems.

Even an account that is not used for government business can therefore have intelligence value. The important question is not simply whether an account handles classified information, but what an attacker could learn from it and how that information might be used.

The distinction between an attempted attack and a confirmed compromise is equally important. Public statements have not yet provided enough technical detail to establish the full extent of the incident. Investigators need to determine whether access was blocked, whether an account was accessed, whether messages were read and whether credentials or other information were exposed. These are different scenarios, with different implications for security.

The incident should also be considered against the backdrop of growing cyber pressure on public institutions. On October 8, Italy’s Foreign Ministry was targeted by a distributed denial-of-service (DDoS) attack that media reports linked to pro-Russian actors. A DDoS attack and an intrusion targeting email accounts are technically different operations, and there is currently no public evidence linking the two incidents.

Their broader significance, however, lies in the pressure they place on institutions and the range of objectives that cyber operations can serve.

Hybrid warfare does not rely on a single method. It can combine cyber operations, intelligence gathering, propaganda, disinformation, economic pressure and other activities designed to exploit weaknesses or influence decision-making. These actions do not necessarily need to be coordinated in every case to contribute to a more hostile strategic environment.

In this context, a cyber operation does not need to shut down a public service to have an impact. An attacker who gains access to political correspondence may seek information about relationships between officials, internal priorities or ongoing discussions. That information could potentially support intelligence operations, help prepare future intrusions or provide material for influence campaigns.

Stolen communications can also be selectively leaked, manipulated or presented without context to damage reputations and undermine public trust. The value of such material may lie less in its immediate technical impact than in how it can be used later. These are possible scenarios, not established facts about the attack on the Chamber.

The public perception of an incident can itself become part of the problem. A successful intrusion, if confirmed, can raise doubts about an institution’s ability to protect sensitive communications. A poorly handled response can deepen those doubts, particularly if officials appear more concerned with reassuring the public than explaining what happened.

None of this proves that the attack was directed by a foreign government or formed part of a coordinated influence operation. Attribution requires technical evidence, intelligence and careful analysis. Treating hybrid warfare as a serious risk means investigating these possibilities without presenting them as conclusions before the evidence supports them.

The Chamber’s statement that the incident was not an emergency because similar attacks occur daily is, at best, an inadequate explanation of the risk. It confuses the frequency of attacks with the seriousness of their potential consequences.

Reassurance has a legitimate role in crisis communication. Institutions should prevent unnecessary alarm and explain when protective measures are working. But reassurance is not a substitute for transparency, especially when the technical investigation is still underway.

The Chamber has acknowledged that cyber pressure has increased against other institutions in Italy and abroad. That admission makes it even more important to explain the nature of the threat and the measures being taken to address it.

A responsible update should clarify what is known about the affected systems, which protective controls were activated, what investigators have established and which questions remain open. Sensitive technical details can be withheld when their disclosure could compromise an investigation or expose additional weaknesses. That does not justify treating the incident as unremarkable before its impact is understood.

The response also needs to go beyond public statements. Authorities should review access controls, authentication mechanisms, account monitoring, email forwarding rules and the procedures used to detect suspicious activity. They should assess whether accounts that are no longer needed remain active and whether older accounts receive the same protection and monitoring as those used every day.

The objective is not to assume that a dormant account caused the incident, but to ensure that every account represents only an acceptable level of risk.

The attack should prompt a broader review of how parliamentary communications are protected and how cyber incidents are handled. New agencies, appointments and organizational structures can contribute to security, but they do not guarantee it. Their value depends on clear responsibilities, technical expertise, adequate resources, tested response procedures and measurable results.

Cooperation between the Chamber and the ACN is important, but the public also needs a clear account of how the incident is being investigated and what corrective action follows. Where the investigation establishes weaknesses, those weaknesses must be addressed rather than obscured by general assurances.

The challenge is particularly significant as Italy and other European countries prepare for future elections. Political institutions may face not only attempts to disrupt their services but also operations intended to collect information, exploit internal divisions or influence public debate. Cybersecurity is therefore part of democratic resilience, alongside the ability to identify manipulated information, communicate reliably and maintain public confidence.

The first priority must be to establish what happened at the Chamber and avoid unsupported claims about the attackers’ identity or objectives. The next is to use the findings to strengthen the security of parliamentary communications and other institutional systems.

An institution’s response should be judged not by its claims that an attack is under control, but by its ability to establish what happened, communicate the risks clearly and fix the weaknesses identified. As hybrid threats grow, downplaying an incident before its implications are fully understood sends the wrong message: protecting the institution’s public image appears to take precedence over identifying and reducing the risks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Italy)

Purpose and Scope This report summarizes the quantity of new ransomware samples collected, the number of compromised systems, and statistics on targeted businesses during the month of September 2026, as well as major Korean & global ransomware issues. The analysis is based on data collected through ATIP (AhnLab Threat Intelligence Platform) and AhnLab Smart Defense, […]

Note The September 2026 Dark Web Breach Incident Trend Report focuses on data breach cases and the sale of initial access credentials posted on the deep web and dark web forums. The report explicitly states that the accuracy of some of its content cannot be fully verified due to the nature of the sources. Major […]

Note The June 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—operating on the deep web and dark web. It is noted that the accuracy of some information could not be verified. Major Issues In Malaysia, a series of website defacement and compromise incidents targeting local development agencies and public […]

If you’ve seen reports of a wildfire in your region and you’re looking for open source data, NASA’s fire-tracking tool is often the first place to start. It provides a heat signature and an approximate location. But detection is only the first step in understanding what’s happened. In this guide, we explore ways to analyse and report on the scale and severity of wildfires, including those in protected areas where ecosystems are often most fragile. We also examine how often fires recur in the same region over multiple seasons, helping to identify patterns in fire activity as climate change reshapes fire risk around the world. 

Satellite imagery from Copernicus Browser will be used to visualise the spread of the fire, and vegetation health indices to assess burn severity. The datasets will then be combined in QGIS for more in-depth analysis. At each stage, suggestions will be offered for turning the data into clear, reportable findings.

Throughout this guide, a single case study will be used: Sicily’s Zingaro Nature Reserve. In 2025, wildfires swept across the region, destroying forests, grasslands and croplands. Located on the Capo San Vito peninsula, the reserve was so severely affected that sections remain closed today. 

Visualising Scorched Earth

When investigating a wildfire, it’s important to narrow down when it occurred and where it spread. The Landsat and Sentinel-2 missions are well-suited to this task, providing regular free imagery of most of the Earth’s landmass.

Below are two sets of Sentinel-2 imagery showing conditions shortly before and after a fire on July 25, 2025, near Capo San Vito, Sicily. The top two images are true-colour, similar to what would be seen from an aeroplane window. The image on the top right shows an area of scorched earth on the eastern side of the peninsula, but the exact extent of the fire is difficult to determine because the colour of the ground has changed only slightly.

The bottom two images are false-colour and highlight the difference between healthy vegetation and burned areas. Such imagery is possible because Sentinel-2 captures bands of light outside the visible range, a technique known as multispectral imaging. In these images, the near-infrared (NIR) band is coloured green, and the shortwave infrared (SWIR) band is coloured red. Healthy vegetation mainly reflects NIR light, so it appears green, while burned areas mainly reflect SWIR light, so they appear red.

These images were created with Copernicus Browser, a free browser-based tool from the European Space Agency for accessing and working with Sentinel imagery. It allows users to browse the Sentinel-2 catalogue by date and visualise different band combinations. You don’t need an account to use the browser, but signing in enables additional features.

If you’d like to try Copernicus Browser without further explanation, you can go straight to the false-colour post-fire image here. 

To follow along step by step, first open Copernicus Browser. Then to visualise Sentinel-2 imagery:

1. Zoom to the desired area on the map or use the search bar (San Vito Lo Capo, north-west Sicily)
2. Select the date of interest (‘2025-07-27’ selected below).
3. Select the layer of interest (‘True color’ by default; SWIR selected below).

By identifying the last available image before the fire and the earliest image after it in which the full burn area is visible, it’s possible to establish the location and timeline of the fire.

This allows us to report the following finding: “Satellite imagery reveals the extent of the damage caused by wildfires across the Capo San Vito peninsula on Sicily’s northern coast between July 20 and July 27, 2025.”

Extra exercise: Look up a recent fire (e.g., wildfires near Penco, Chile in January 2026), navigate to the affected location and try to visualise the burned area using Copernicus Browser.

Quantifying the Burned Area

The visibly scorched area can be measured using the Area of Interest tool (highlighted below), which allows users to draw a polygon on the map and calculate the total area in square kilometres. (Once drawn, keep the polygon in the editor, as it will be used again later.)

Reportable finding: “The wildfire that swept across Sicily’s Capo San Vito peninsula in 2025 burned more than 50 km2 of the peninsula, according to Sentinel-2 data.”

Repeatedly measuring the burned area over time allows you to follow the progression of a fire. This method was used by Bellingcat when covering the Etosha National Park wildfire in late September 2025.

Extra exercise: Replicate the analysis of the Etosha National Park fire from this Bellingcat article.

Assessing Burn Severity 

Some fires only affect surface vegetation, while others scorch the ground and cause long-lasting damage. Burn severity can be measured using an index called the Normalised Burn Ratio (NBR).

How Does the Normalised Burn Ratio (NBR) Detect Burned Areas?

The spectral response of a material describes how reflective it is to different types of light. The graph below shows the difference between healthy vegetation and bare soil in terms of the amount and types of light they reflect.

By focusing on the NIR and SWIR bands, where reflectivity differs significantly between healthy vegetation and bare soil left after a burn, an index can be calculated: 

NBR = (NIR – SWIR) / (NIR + SWIR) 

A high NBR indicates healthy vegetation, while a low NBR indicates burned areas.

Copernicus Browser doesn’t include a default NBR layer, but it can be added via a custom script, as shown in the screenshot below:

1. Select ‘Custom’ in the layer selector.
2. Switch from the ‘Composite’ to the ‘Custom’ tab.
3. Check ‘Load script from URL’.
4. Paste this URL: https://bellingcat-scripts.ams3.cdn.digitaloceanspaces.com/NormalizedBurnRatio.js 
5. Load the script by clicking the green circular arrows to the right of the URL.
6. Click ‘Apply’ (you may need to scroll down).

Alternatively, you can skip these steps and go straight to the custom NBR post-fire image here.

The NBR layer displays positive values in green (healthy vegetation) and negative values in purple (burned areas), making the boundary of the scorched area much clearer than before.

To calculate the change in NBR in Copernicus Browser, use the Statistical Information tool (a free account is required to access this feature).

1. Within the date selector, choose a date a few weeks or months after the fire.
2. Using the Area of Interest polygon, select the ‘Statistical Info chart’ icon.
   
   
   

3. Set the maximum cloud cover to around 30% using the slider in the top right.
4. Select a date range that captures the available data surrounding the fire (July 20-27 shown below).
5. Identify when the fire occurred on the graph (this will be marked by a sharp drop in the NBR, as shown below).
6. Hover over the points on the graph immediately before and after the fire to display the mean value.

In this example, the pre-fire image had an average NBR of 0.11 and the post-fire image had an average NBR of -0.18. The NBR decreased by 0.29, which represents a moderate burn.

Severity Level	Change in NBR
Unburned	Less than 0.100
Low	0.100 – 0.269
Moderate	0.270 – 0.659
High	0.660 or greater

Reportable finding: In late July, the fire, which scorched more than 50km2 of Sicily’s Capo San Vito peninsula, was deemed moderately severe according to the US Forest Service guidelines. 

Extra exercise: Find a custom visualisation script of interest from this repository and explore what it does.

Wildfires in Conservation Areas

By focusing on protected sites such as nature reserves and national parks, we can begin to assess how wildfires affect areas of high conservation value. Controlled burns are widely used in agriculture and land management, but unchecked fires in protected areas risk eroding fragile ecosystems.

The proportion of the Zingaro Nature Reserve that was damaged by the fire can be estimated by combining the NBR image created in Copernicus Browser with a dataset from Protected Planet, a global map of protected areas that includes nature reserves.

QGIS, a program for working with geographic data, is well-suited for this type of analysis. Download and install QGIS on your computer. For help with this step, refer to the QGIS installation guide.

To download the NBR image from Copernicus Browser:

1. With the NBR visualisation selected, click the ‘Download’ icon. 
2. Switch tabs at the top from ‘Basic’ to ‘Analytical’.
3. Change the image format to ‘TIFF (32-bit float)’.
4. Change the image resolution to ‘HIGH’.
5. Change the coordinate system to ‘Popular Web Mercator (EPSG:3857)’.
6. Toggle the ‘Clip extra bands’ switch to the off position (see image below).
7. Select the ‘Custom’ layer check box (and deselect any others).
8. Click ‘Download’.
9. Wait. It could take several minutes for the image to be generated and downloaded.

Once the image has downloaded, rename it to NBR.tiff to make it easier to work with. 

Next, open QGIS and click ‘New Project’ in the upper left. 

Load the image from Copernicus Browser by dragging and dropping the downloaded file into QGIS.

Useful QGIS Terminology

CRS – The Coordinate Reference System describes how the world should be measured and projected. Two of the most common are:

EPSG:4326 – WGS 84, which uses latitude and longitude as the unit of measurement.

EPSG:3857 – WGS 84 / Pseudo-Mercator, which uses metres as the unit of measurement.

Raster – a type of data that uses pixels to represent information (such as satellite imagery)

Vector – a type of data that uses points, lines, and polygons to represent information (such as a burn area polygon).

Processing the NBR Image

Next, we categorise each pixel in the NBR image as burned or unburned. 

Previous analysis in Copernicus Browser showed that the Zingaro Nature Reserve’s NBR value dropped below zero only after the fire (before image: mean NBR value on July 20, 0.11; after image: mean NBR value on July 27, -0.18).

We can use this analysis to set a threshold; anything below zero will be categorised as burned.

The QGIS Raster Calculator lets us apply our threshold to the NBR image and create a new layer. 

Open the Raster Calculator by selecting ‘Raster > Raster Calculator…’ from the menu bar at the top.

The Raster Calculator lists the raster bands available in the project. In this example, there are five. These bands are set by the custom script we used in Copernicus Browser and are numbered as follows:

1. Red
2. Green
3. Blue
4. Pixel validity (not used in this example)
5. NBR index

To create a new raster layer that applies our threshold on the NBR index band:

1. Double-click the fifth band (ending ‘@5’) to add it to the expression box at the bottom. 
2. Add < 0 using your keyboard (shown above).
3. Select the ‘Create on-the-fly raster instead of writing layer to disk’ checkbox.
4. Click ‘OK’.

The expression NBR@5 < 0 tells QGIS to categorise NBR index values as burned if they are less than zero. 

The new layer shows burned areas as white (a value of 1), and unburned areas as black (a value of 0).

Extra exercise: Download an NBR image captured before the fire. Use the Raster Calculator to create a new layer that shows burn severity.

Adding Conservation Area Data

Download the Zingaro Nature Reserve dataset from Protected Planet by selecting ‘Download > File Geodatabase’.

As before, drag and drop the downloaded file into QGIS. This time, the download is a zip file and contains many PDF files as well as the geodatabase file of interest. Scroll down to the bottom of the list and select the ‘gdbtable’ file with a polygon icon on the left side (see the blue highlighted row below), then press ‘Add Layers’.

This adds the nature reserve polygon as a layer in QGIS (and gives it an arbitrary colour). The nature reserve is almost completely contained within the white burned area, indicating it was heavily affected by the wildfire.

Quantifying the Burned Area in the Nature Reserve

To measure the proportion of the nature reserve that was burned by the wildfire, we will use the Zonal Histogram tool from the QGIS Processing Toolbox to count the number of unburned and burned pixels within the reserve polygon.

Open the toolbox with ‘Processing > Toolbox’, and a pane should open to the right. In the Processing Toolbox search field, look up ‘Zonal Histogram’ and double-click the result to open the tool.

To create a new layer:

1. Set the ‘Raster layer’ to the threshold burn area layer (NBR@5 < 0)
2. Set the ‘Vector layer containing zones’ to the nature reserve polygon layer (should start with ‘WDPA_’).
3. Click ‘Run’
4. Click ‘Close’

This will create a new layer called ‘Output zones’, which is a copy of the nature reserve polygon with pixel counts added.

Select the output layer in the lower left and click ‘Attribute Table’ in the upper right. (The attribute table is a spreadsheet-like view of the data contained in a layer.) 

For the output layer, there is just one row because there is only one polygon. If the layer contained many polygons, there would be many rows.

The newly calculated counts are added to the end of the table, so scroll all the way to the right. Look for fields starting with ‘HISTO_’. Here, HISTO_0 is the count of unburned pixels (value of 0), and HISTO_1 is the count of burned pixels (value of 1).

To calculate the proportion of burned area, the number of burned pixels is divided by the total number of pixels.

Proportion = 57413 / (57413 + 2195) = 0.96318…

A value of 0.96318 means that just over 96.3% of the nature reserve burned.

Reportable finding: In late July, more than 95% of the Zingaro Nature Reserve burned in a wildfire, according to Sentinel-2 satellite imagery and Protected Planet data.

Tracking Past Wildfires

To assess the significance of an ongoing wildfire, it is important to place it in historical context. How does it compare with previous fires in the same area? Is it part of a seasonal pattern, or does it represent an unusually severe event?

With coverage dating back to 2008, the European Forest Fire Information System (EFFIS) automatically maps wildfires across Europe, North Africa, and parts of the Middle East.

Fire data can be requested directly from EFFIS using web form, with results delivered by email. For ease, you can also download Bellingcat’s archived copy of EFFIS wildfire data for Italy covering 2015–2025.

For this section, it is best to open a new QGIS project.

To view and analyse historic wildfires in the Zingaro Nature Reserve using EFFIS data:

1. (Optional) Add the OpenStreetMap layer from the XYZ Tiles category by double-clicking it.
2. Load the EFFIS data into QGIS. If prompted to select a coordinate transformation, click ‘OK’ to accept the default option. 
3. Load the Protected Planet Zingaro Nature Reserve polygon as described earlier. 
4. Open the Vector Intersection tool by selecting ‘Vector > Geoprocessing Tools > Intersection…’ from the menu bar at the top.

The Intersection tool creates a new layer containing only the fires that affected the Zingaro Nature Reserve. To create the new layer:

5. Set the ‘Input layer’ to the EFFIS fires layer.
6. Set the ‘Overlay layer’ to the Zingaro Nature Reserve polygon layer.
7. Click ‘Run’.

QGIS functionality can be extended through plugins, including Data Plotly, which adds data visualisation tools. To install Data Plotly, open the Plugin Manager by selecting ‘Plugins > Manage and Install Plugins…’ from the menu bar, then:

8. Search for ‘Data Plotly’ in the available list.
9. Select the plugin from the search results.
10. Click ‘Install Plugin’ to download and install it. 

Once installed, open the Data Plotly panel with ‘View > Panels > DataPlotly’. The panel should appear on the right-hand side of the QGIS window. 

To plot a graph of historic wildfire activity within the nature reserve, configure Data Plotly as follows:

1. For ‘Plot type’, choose ‘Bar Plot’.
2. Set the ‘Layer’ to the newly created ‘Intersection’ layer.
3. In ‘X field’, type “year(initialdat)”. This expression extracts the year from the fire’s approximate start date, allowing events from the same year to be grouped together. 
4. In ‘Y field’ enter “$area/1000000”. This expression calculates the burned area within the nature reserve in square kilometres.

Note: EFFIS data provide initial and final dates for each fire, which are approximate because they depend on the availability of satellite imagery. These dates should be treated as bounds for when a fire occurred, rather than as the dates when it started and ended.

Next, switch to the Layout tab in Data Plotly:

5. Untick ‘Show Legend’. Only do this for simple plots where a legend is not required. 
6. Add a title and labels for the X and Y axes.
7. Finally, click ‘Create Plot’ and wait a few seconds for the chart to be generated.

The chart shows that the Zingaro Nature Reserve has experienced several significant wildfires over time. However, in 2025, the data show that the fire burned a larger area within the reserve than the major fires recorded in 2020 and 2017.

Reportable finding: The Zingaro Nature Reserve has experienced three major wildfires since 2015. Of these, the 2025 fire burned a larger area within the reserve than those recorded in 2020 and 2017.

The tools and methods in this guide can be applied to wildfires in many other regions. By combining satellite imagery with environmental and historical datasets, it’s possible to move beyond detection and begin to quantify a fire’s impact. In doing so, you can also place individual incidents in context, revealing whether they are part of a recurring pattern or an unusually severe event.

To learn more about fire detection, see Bellingcat’s guide to NASA FIRMS.

To explore QGIS further, visit the Bellingcat toolkit entry on QGIS.

---

Merel Zoet and Claire Press contributed to this report.

This guide contains modified Copernicus Sentinel data (2025), processed with Copernicus Browser, as well as data from the European Forest Fire Information System (EFFIS) of the European Commission Joint Research Centre.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Burning Forests: Tools for Tracking and Reporting Wildfire Damage appeared first on bellingcat.