According to prosecutors in Rome and Naples, journalist Francesco Cancellato and activists Giuseppe Caccia and Luca Casarini were hacked in the early hours of 14 December 2024. The hacking suggests all three were part of the same 'infection campaign'. Traces of malware activity were found exclusively on three Android devices among all mobile phones acquired by plaintiffs.
The three Android devices belong to Giuseppe Caccia, Luca Casarini, and Francesco Cancellato. The serial execution of three attacks on the same night suggests they may have been part of a single infection campaign. Prosecutors in Rome and Naples confirmed that Francesco Cancellato was hacked, marking a departure from the previous parliamentary report.
Francesco Cancellato was the first person in Italy to come forward publicly about being hacked. However, prosecutors said the investigation could not find evidence that secret services spied on Francesco Cancellato, but will continue to identify perpetrators. The technical investigation was conducted by the Postal Police together with a board of university professors on the phones of seven people.
Complaints were filed after Meta notified those affected of possible compromise of their devices. An Italian parliamentary committee (Copasir) found that Italian intelligence agencies legally targeted activists Giuseppe Caccia and Luca Casarini, but found no evidence that Francesco Cancellato had been targeted. A Copasir report from 4 June 2025 documented the use of Graphite spyware by the Internal Security Agency with legal authorization.
This creates a discrepancy: while the parliamentary committee found no evidence Cancellato was targeted, prosecutors have confirmed he was hacked. The discrepancy centers on whether Francesco Cancellato was targeted by Italian intelligence agencies, with the parliamentary committee stating there is no evidence, and prosecutors confirming the hack occurred. WhatsApp revealed in early 2025 that 90 people, including journalists and civil society members, were targeted by hacking software made by Paragon Solutions.
Paragon Solutions, a spyware maker founded in Israel but now owned by US investors, sells its spyware Graphite to government agencies for crime prevention. The anomalies found in WhatsApp databases are compatible with the functioning of Graphite spyware. Paragon cancelled its contract with the Italian government after reports emerged that Francesco Cancellato had been targeted.
Giorgia Meloni has denied any involvement in the hacking of journalist Francesco Cancellato, according to major media reports. The scandal has contributed to a decline in press freedom in Italy, with its World Press Freedom Index ranking dropping from 41st in 2023 to 49th in 2025, reports indicate. Prosecutors in Rome and Naples are proceeding against unknown persons for crimes including unauthorized access to computer systems and illegal interception of communications.
Intelligence chiefs Giovanni Caravelli (Aise) and Bruno Valensise (Aisi) were heard as witnesses in the investigation. Judicial authorities accessed Aisi files under Article 256-bis. Who specifically targeted Francesco Cancellato and why remains unknown, given the lack of evidence linking it to intelligence agencies.
Whether the hacking of Cancellato was authorized or illegal, and if it was part of the same campaign as the activists, has not been determined. The full extent of the hacking campaign, including whether other individuals beyond the 90 reported by WhatsApp were affected, is still under investigation. The presumed period of compromise of the devices dates back to the early hours of 14 December 2024.