On 7 November 2026 the Italian Data Protection Authority, the Garante per la protezione dei dati personali, warned media outlets, news sites and platforms the data of deputy prime minister Antonio Tajani and his family that ended up on the dark web. Taking up or republishing it can itself be a violation of the law. A few days later an ad appeared offering an alleged DIA archive, not authenticated. For anyone who runs websites and handles data, the lesson is how to treat material that comes from illegal activity.
A few terms before we get into the facts. Dark web is the part of the internet reachable only with dedicated software, where forums and markets, some of them illegal, operate. Dump means a massive copy of data extracted from a system. Hash is a file's digital fingerprint, used to compare copies and verify integrity. Social engineering refers to techniques that deceive people, for example with credible phishing emails. Monero and Bitcoin are cryptocurrencies used for payments.
What did the Garante say the Tajani case?
In the statement, dated Rome 7 November 2026, the Garante states that acquiring, disseminating and republishing, by any means, data coming from illegal activities constitutes in turn a violation. This also applies when the person concerned is a public figure.
The Authority says it will monitor the circulation of that data. If necessary it will urgently adopt measures limiting or banning the processing and will ask platforms to remove the content.
The message for those who publish is clear. Data that came out of a theft does not become free to use just because it is already circulating. Those who pass it on are also accountable.
What was put up for sale under the DIA's name?
According to Cybersecurity360 , a seller signing as «weykofa» offers on a forum an alleged archive of 302 files, 222 megabytes, attributed to the Direzione investigativa antimafia. The ad is dated 8 November 2026.
According to Punto Informatico , the description mentions information on 25 criminal organisations, operational dossiers, communications with Europol, unpublished photos and personal data of three employees. Payment is in Bitcoin or Monero, on request.
These are all claims by the seller. None has been verified.
Why is it not known whether the files are authentic?
No usable samples are available. The screen shows the word «SAMPLE», but no set of documents allows independent checking. Fanpage, Cybersecurity360 reports, did not find a verifiable sample and asked the DIA for clarification without receiving an answer.
Some details used to lend credibility to the offer are public. The figures for the @ON network, 55 police forces from 45 countries, already appear on the DIA's website. This is consistent with the use of open sources, but does not prove it.
Even with authentic files, it would still be necessary to understand where they come from. An external attack, a legitimate access misused, an error and a leak from a supplier are different hypotheses. Those who want to learn how a system is defended can start with the web security guide for developers .
What risks exist even if the files are public?
Cybersecurity360 lists four. The first is mixing, meaning true and false material together, credible because partly checkable. The second is fraud or extortion, possible even without any theft. The third is social engineering, with more credible anti-mafia themed phishing emails. The fourth is disinformation, because an alarmist headline leaves the impression of a breach that has never been proven.
Punto Informatico places the case within a series of recent episodes and speaks of possible attacks coordinated by Russian groups. This is the newspaper's hypothesis, with no evidence in the source. Cybersecurity360 warns that the name in the ad is not enough for attributions or automatic links.
On the political side, Punto Informatico reports Crosetto's words on hybrid warfare and those of deputy Bonelli on cuts to the cybersecurity strategy. The national committee for public order and security was due to meet at the Viminale.
It is not verified that the DIA archive exists, is authentic, or comes from access to its systems. It is not known when the data would have been stolen. Responses from the DIA and the Interior Ministry are missing. The Garante's statement does not specify which sites or outlets are involved, nor which of Tajani's data has circulated. The hypotheses of Russian involvement are not proven.
What changes for people working with digital
If you run a website, a blog or a profile with an audience, do not republish data that came out of breaches, not even to on it. The Garante says republication is also a violation. Think carefully quotes and images of stolen material.
If you work in a company, expect phishing emails built with public and credible details. Even a fake case can generate real attacks. A recent case of leaked credentials is that of DreamHost , useful for reviewing response procedures.
The Garante's caution is right, but the most delicate part lies in newsrooms and on social media. An ad on a criminal forum is a claim by the seller, not a fact. Headlines that treat an offer as a breach play into the seller's hands, who gets attention for free. It is always necessary to distinguish between what is proven and what is merely claimed. The real risk lies not only in the files, but in the climate that forms around them.
Frequently asked questions
What did the Garante prohibit regarding Tajani's data?
It did not prohibit anything in general, it issued a warning. It stated that acquiring, disseminating and republishing data from illegal activity is a violation. It can intervene with urgent limitations or bans.
Was the DIA data really stolen?
It has not been proven. Sources report there is no confirmation of either the theft or the authenticity of the files. Many of the documents cited are already public.
How large is the archive for sale?
222 megabytes, with 302 files. These figures are claimed by the seller and have not been verified.
Who discovered the ad?
The report circulated on X via the account Dark Web Informer. It was then picked up by several outlets, including Fanpage.
Do public figures have fewer data protections?
No, at least according to the Garante. The Authority says the violation still applies when the person concerned is a public figure.
What to watch in the coming days on the DIA case and politicians' data
The matter will be settled by official confirmations or denials and by any measures from the Garante. Until then it is best to stick to the facts.
Follow official communications from the DIA and the Interior Ministry before sharing news the archive.
Check whether the Garante adopts limitation or ban measures and which platforms it involves.
Review your internal rules on quoting and republishing material coming from breaches.
cybersecurity360.it, DIA, presunti dossier in vendita sul dark web – ecco cosa sappiamo
punto-informatico.it, Dati della DIA in vendita sul dark web, archivio da 222 MB
Apple Store, subscriptions activated without consent and metric removed
According to Louis Rossmann's claims, some Apple Store staff activated paid trials without consent. Apple has removed th...
Check Point, hotfix for PHP2Shell on Firewall and Security Gateway according to ACN
ACN flags Check Point hotfixes for PHP2Shell (CVE-2026-109618 and 109619) on Firewall, Security Gateway and Spark. Here...
Google TPU 8tx and 8i Max, two new systems for secure AI agents and huge contexts
Google unveils TPU 8tx for private inference and TPU 8i Max for huge contexts. What the company claims and what it means...
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
