Banks and insurance companies under attack: hackers go through emails

Banks are especially targeted by cybercrime. Hacktivist groups prevail against insurance. In the first nine months of 2026, Csirt Italia detected 168 events in the two sectors, 47 of which were classified as accidents, i.e. with a confirmed impact. This is the budget presented by the general director of the National Cybersecurity Agency (ACN) Quacivi to the Commission of Inquiry into the Italian banking system.

The banking sector concentrates 137 events and 44 incidents; the insurance one, respectively, 31 and three. The threat matrix also changes. In banks, 64% of events are traced back to cybercrime, 32% to hacktivist groups and 4% to internal subjects. In insurance, the hacktivist component accounts for 83%, with events consisting almost entirely of DDoS attacks and an impact confirmed in less than one case in ten.

Geopolitical tensions fuel these campaigns, but the effects have generally been limited thanks to the mitigation capabilities of the operators and the alarms of Csirt Italia.

Then there is the burden of failures. «The main cause of the accident, however, was of a non-cyber nature», explains Quacivi: twelve of the 47 accidents were caused by failures, all in the banking sector. The accident count therefore also includes operational malfunctions.

«E-mail confirms itself as the main access vector in both sectors», underlines the director of the ACN. Compromised company mailboxes and stolen credentials remain crucial steps. Added to these is the exploitation of vulnerabilities, especially in perimeter security systems.