Italy bought Israeli Graphite spyware. Who hacked Fanpage's editor is still unknown

Italy's parliamentary security committee says the country's spy agencies did not break the law in the Graphite cases it checked. Rome and Naples prosecutors say a Fanpage editor's phone was hit with the same Israeli-made tool on the same night as two migrant-rescue activists. They found no matching job on the domestic agency's server. More than a year after Italian prosecutors asked Israel for help from Paragon Solutions, Wired Italia reported in June 2026 that no real reply had come.

That mix of confirmed hacks, cleared service logs and unanswered legal requests is what Italians mean by the Israel–Italy spying scandal. It is not a case of the Israeli government spying on Italy. The confirmed Graphite users inside Italy were Italian. The domestic agency AISI and the foreign agency AISE bought the tool from Paragon, an Israeli-founded company later sold to U.S. investors. Who infected journalist Francesco Cancellato is still unknown.

What is confirmed, and what is not#

Three layers of fact should stay apart.

First, Italian intelligence bought and used Graphite. COPASIR is the Parliamentary Committee for the Security of the Republic. Its 2025 activity report says members inspected Paragon databases and audit logs at AISI and AISE offices. The June 4, 2025 COPASIR report was approved by every member. It said the agencies lawfully targeted Mediterranea Saving Humans co-founders Giuseppe Caccia and Luca Casarini after getting the approvals Italian law requires. Wired Italia put the known contracts at about €2 million for the two agencies combined.

Second, experts hired by prosecutors confirmed malware activity that fits Graphite on three Android phones: Caccia's, Casarini's and Cancellato's. In a March 5, 2026 joint statement, the Rome and Naples prosecutors' offices said the likely breach window was the early hours of December 14, 2024. "The serial execution of three attacks on the same night suggests that they may have been part of a single infection campaign," the statement said, according to The Guardian and TechCrunch.

Third, the same prosecutors inspected the Graphite server used by AISI. They found jobs against Caccia and Casarini that night. They found none against Cancellato. Their hunt for who targeted the journalist goes on. COPASIR's clearance covers the people and logs it checked. It does not replace the criminal cases. The committee said so when it published its later activity summary.

A WhatsApp alert, a Citizen Lab note, or a place on a parliamentary list is not proof that a named Italian minister ordered a journalist's phone hacked. The Meloni government has denied using Graphite against Italian journalists. Paragon says it sells only to democratic governments and bars use against journalists and civil society. Neither denial answers who hit Cancellato.

How the case started#

On January 31, 2025, WhatsApp told about 90 people across roughly two dozen countries that they had been targeted with Graphite. Seven of the alerts were in Italy. Cancellato, editor-in-chief of the investigative site Fanpage, was the first Italian to speak in public. Fanpage had run critical reporting on Brothers of Italy, including an undercover look at far-right networks around the party's youth wing. Other Italian recipients named in later reporting included Caccia, Casarini, political consultant Francesco Nicodemo and, according to IrpiMedia, businessman Francesco Caltagirone.

On April 29, 2025, Apple sent some Italian users notices of a "sophisticated attacker." Fanpage reporter Ciro Pellegrino was among them. Citizen Lab at the University of Toronto later told him it had found Graphite traces on his iPhone with high confidence. The March 2026 prosecutors' technical report covered phones taken from people who filed complaints. It said it found malware traces only on the three Android devices belonging to Caccia, Casarini and Cancellato, not on Pellegrino's iPhone. Pellegrino told TechCrunch he was "pretty disconcerted" that prosecutors' experts did not match Citizen Lab's finding. That conflict is still open in the public record.

The wider European pattern matters for context, not for blame. Germany's BSI warned lawmakers in early November 2026 that Apple had flagged possible mercenary-spyware attacks on Bundestag and cabinet iPhones. It did not name a vendor or a state. Spain, Poland, Greece and Hungary have each faced their own commercial-spyware inquiries in recent years. Italy's case stands out for two reasons. The government has said its own agencies were Paragon customers. Prosecutors later confirmed a journalist infection that those agencies' server logs do not explain.

What COPASIR found, and what it left out#

COPASIR lacks the full powers of a parliamentary commission of inquiry. It still held hearings, visited DIS, AISI and AISE sites, and checked approval decrees as well as Graphite audit logs. Members entered the phone numbers of WhatsApp-alert recipients into the system to see whether Italian services had run Graphite against them. For the people in the June 2025 report's scope, the committee said it found no breaches of the law then in force.

The August 2026 activity report covering 2025 work repeated that conclusion for the cases it checked. It added that the committee had kept looking at other alleged phone breaches reported in the press, including other journalists and well-known figures in Italian business and finance. The delegated authority for republic security told COPASIR those further checks also showed the services operating within the rules, according to CybersecItalia's summary and FNSI's account of the Adnkronos readout.

COPASIR also said its work did not cover the open prosecutorial files. That limit matters. A unanimous parliamentary clearance of specific agency logs is not a finding that no illegal Graphite use occurred anywhere, by anyone, on Italian soil. It is a finding about what that committee saw in the systems and approvals it inspected.

1. 2024-12-14Early-hour Graphite-compatible infections on phones of Caccia, Casarini and Cancellato
2. 2025-01-31WhatsApp alerts ~90 users, including seven in Italy; Fanpage's Cancellato goes public
3. 2025-04-29Apple warns some Italian users of a sophisticated attacker; Pellegrino later named
4. 2025-06-04COPASIR unanimously says AISI/AISE lawfully targeted Caccia and Casarini; no Cancellato hit in agency logs
5. 2025-06Paragon says it terminated Italy contracts after authorities declined its verification offer; Rome says the end was mutual
6. 2026-03-05Rome and Naples prosecutors confirm the three infections and the missing Cancellato entry on the AISI server
7. 2026-06Wired Italia reports Italian mutual legal assistance requests to Israel still unanswered after more than a year
8. 2026-08COPASIR activity report says no legal violations in examined cases; further checks on other journalists and business figures continue

Source: Rome/Naples prosecutors via TechCrunch, COPASIR activity report via CybersecItalia, Wired Italia

Paragon, Israel and the contract fight#

Paragon Solutions was founded in Israel in 2019 by people with Israeli intelligence backgrounds. It was backed by former Prime Minister Ehud Barak. Reuters reported in December 2024 that Florida-based AE Industrial Partners bought it for about $500 million and planned to merge it with Virginia cybersecurity firm Red Lattice. Export of the technology still sits under Israeli defense-ministry licensing. Wired Italia stressed that point when it described Tel Aviv's broader stance toward spyware vendors.

In a statement carried by Haaretz and confirmed to TechCrunch in June 2025, Paragon said it had offered the Italian government and parliament a way to check whether its system had been used against the journalist in breach of Italian law and contract terms. "As the Italian authorities chose not to proceed with this solution, Paragon terminated its contracts in Italy," the company said.

Italian sources told ANSA the pause and later end of the relationship were mutual. The Department of Information for Security (DIS) said letting Paragon inspect Graphite logs would expose secret data to a private foreign company and would not meet national-security rules. COPASIR said Paragon's technical help was not needed because checks could be done on site. Those accounts can both be true as descriptions of each side's stance. They do not settle who infected Cancellato.

Wired Italia's June 2026 investigation said Italian prosecutors had used mutual legal assistance channels to ask Israel to get information from Paragon about software, clients and who ran the attacks. More than a year later, it said, no real response had come. The magazine said Israeli authorities and Paragon did not reply to its requests for comment before publication. Human-rights lawyer Eitay Mack told Wired that Israeli spyware firms sit in a gray zone. They are private companies whose exports the Defense Ministry licenses. Tel Aviv rarely forces them to help foreign courts. That is Mack's argument about Israeli policy. It is not evidence that Israeli agencies ran the December 14 infections in Italy.

The Meloni government and the opposition#

Prime Minister Giorgia Meloni has repeatedly pointed to the June 2025 COPASIR report. At her early-2026 press conference, she said Graphite had not been used to spy on Italian journalists. She said the unanimous committee document ruled out its use against Cancellato, according to CybersecItalia. She also said two prosecutors' offices were investigating and that intelligence agencies were giving "all the necessary support." When Cancellato asked her directly about the government's role, she said it was "offering all its assistance and all the answers it can provide to help clarify this issue," according to TechCrunch. She also said her own life had "ended up in the newspapers."

Undersecretary Alfredo Mantovano is the delegated authority for security. He has defended the services in similar terms. Presenting the annual information-security policy report, he said COPASIR had approved its findings unanimously. He said the Naples and Rome investigations were not finished. He said he awaited their conclusions "with serenity" in the certainty that the agencies had fully respected the law. He confirmed that contracts with Paragon had already been cut. Mantovano's office and Palazzo Chigi have steered further secret detail to COPASIR rather than to open chamber question time.

The opposition treats that as evasion. In February 2025, Partito Democratico and Italia Viva said the government refused to answer chamber questions on whether prosecutors' offices or the prison police were among Graphite users. Sandro Ruotolo of the PD said the public "has the right to know the truth." Nicola Fratoianni of Alleanza Verdi e Sinistra called the refusal "very serious." Francesco Silvestri of the Five Star Movement asked Meloni to appear in Parliament over "the many and growing shadows" on the case, according to ANSA. Davide Faraone of Italia Viva said state secrecy "cannot be put" over prosecutors and prison police.

At the European Parliament in Strasbourg in February 2025, PD, M5S and AVS MEPs hosted Cancellato and Casarini and asked President Roberta Metsola for a special inquiry committee. Casarini said the episode "smells a lot like a regime." Nicola Procaccini of Brothers of Italy called the idea that Meloni would spy on Casarini and Cancellato "so ridiculous that it is hard to comment on," according to Eunews. Elly Schlein, linked from afar, said Meloni "cannot keep hiding and fleeing." Those are partisan charges and defenses. They do not change the forensic timeline.

Matteo Renzi of Italia Viva framed a different choice. Either the government did it and is lying, he said, or it did not and was "taken in" by someone else who used a tool Italian services had bought. That either-or is a political argument, not a prosecutorial finding. It does show why the missing Cancellato entry on the AISI server keeps the scandal alive after COPASIR's clearance.

What the targets say#

Cancellato's public stance has been steady. Someone got into his phone on December 14, 2024, and he wants to know who. After the March 2026 prosecutors' statement, he called it "a small, important step towards the truth." He asked politicians, the government and Parliament to help identify the authors without rushing readings, according to The Guardian. In his Fanpage article the same day, he said the government had stayed silent when it could and, when it spoke, had "told lies." That is his charge. Meloni's office has not published a point-by-point reply beyond the COPASIR citations and offers of help to prosecutors.

Casarini's phone does show up as a Graphite target on the AISI server. He has linked the case to Italy's Libya policy and migrant-rescue politics. Mediterranea's work sits at the center of fights over sea rescues that also feed broader cost-of-living and security debates, including the October 2026 grassroots strike over prices and defense spending. COPASIR said the Caccia and Casarini jobs were approved. Civil-society groups say targeting rescue organizers with mercenary spyware chills lawful advocacy even when a judge signed off. Both statements can be reported without settling the value dispute.

Citizen Lab researcher John Scott-Railton said the prosecutors' confirmation made it "impossible to dismiss" Cancellato's case. He said it raised "serious questions about why no confirmation was surfaced in prior official investigations." He also told Wired that spyware companies "present themselves as partners to law enforcement, but pick and choose which laws to follow." Those are researcher judgments about process and incentives. They are not court verdicts.

A separate Milan data scandal, briefly#

Readers sometimes fold a second Italy–Israel thread into the same phrase. Equalize, a Milan private-investigation firm, is accused of illegally accessing Italian state and commercial databases and selling dossiers. Wiretaps reported by POLITICO and Italian outlets in late 2024 described a February 2023 meeting in which alleged Israeli intelligence contacts discussed a roughly €1 million job tied to Russian and Wagner money trails. A Milan judge later wrote of "granite-hard" proof of a criminal group around illegal profiling. A large first hearing was set for October 2026. Equalize is a private-hire data-theft case with alleged foreign clients. It is not the Paragon Graphite infection campaign. Mixing them blurs who ran which tool.

What remains open#

Several factual gaps still drive the story.

Prosecutors have not publicly named who ran the December 14 Graphite-compatible attack on Cancellato. AISI's checked server does not show it. A Wired source called AISE's foreign-target contract the larger of the two. No public filing has pinned Cancellato's infection on AISE either. Pellegrino's Citizen Lab finding and the prosecutors' null result on his iPhone have not been reconciled in a published expert report. Italian mutual legal assistance requests to Israel about Paragon were still unanswered as of Wired's June 2026 check. COPASIR's later look at other journalists and business figures has not produced a new public list of confirmed Graphite targets beyond the Caccia–Casarini–Cancellato set.

For Italy's party map and the coalitions around Meloni, see Italy's political spectrum. For Israel's party map, see Israel's political spectrum. Neither chart measures spyware policy. Both give context for the governments that buy, license or police these tools.

The accurate short version is therefore narrow. Italian agencies bought Israeli-made Graphite and, on the COPASIR record, used it lawfully against two activists. Independent forensic work says a critical journalist was hit the same night with the same family of malware. The Israeli company that sold the tool and the Italian state that bought it disagree about why their contracts ended. Israeli authorities had not, as of mid-2026, delivered the maker help Italian prosecutors say they need. Calling that an "Israel–Italy spying scandal" is fair as a label for a dispute over an Israeli product used in Italy. Calling it Israeli state espionage against Italy is not what the open sources show.

Differing perspectives

How should Italy resolve who used Graphite against Fanpage's editor?

Each position is summarized as its supporters make it, with equal weight and in alphabetical order. A summary is not an endorsement; the evidence for each is weighed in the story above.

• Force open parliamentary answers

  Who holds it: Partito Democratico, Five Star Movement, Alleanza Verdi e Sinistra and Italia Viva

  Opposition leaders say the public has a right to know which Italian bodies used Graphite, whether prosecutors or prison police were customers, and why the government refuses chamber questions. They call Meloni's reliance on classified COPASIR briefings a dangerous precedent and have sought a European Parliament inquiry as well as Meloni's appearance in the Italian chamber to clear what they call growing shadows on the case.

  In their words: ANSA ↗

• Identify who infected Cancellato

  Who holds it: Fanpage editor Francesco Cancellato

  Cancellato says prosecutors have now confirmed that someone entered his phone on December 14, 2024, and stole messages. He asks the government and Parliament to help identify the authors without rushing interpretations. He says the government stayed silent when it could and, when it spoke, gave accounts he rejects as false. For him the core demand is naming the operator, whether domestic or foreign.

  In their words: The Guardian quoting Cancellato ↗

• Require the vendor's cooperation

  Who holds it: Paragon Solutions, as stated when it ended Italy contracts; Citizen Lab researcher John Scott-Railton

  Paragon says it offered Italy a way to verify whether Graphite was misused against the journalist and terminated contracts when authorities declined. Scott-Railton argues spyware makers present themselves as partners to law enforcement yet pick which laws to follow, and that manufacturer cooperation is essential to attribute infections. Both stress that without the company opening its systems, victims and courts stay stuck.

  In their words: TechCrunch quoting Paragon statement ↗

• Trust COPASIR and wait for prosecutors

  Who holds it: Prime Minister Giorgia Meloni and Undersecretary Alfredo Mantovano

  They argue the unanimous June 2025 COPASIR report already showed Graphite was not used by Italian services against Italian journalists, that the services respected the law in the cases examined, and that Naples and Rome prosecutors have the agencies' full cooperation. Further classified detail, they say, belongs in COPASIR rather than open chamber debate, and the unfinished criminal files should finish before new political judgments.

  In their words: CybersecItalia reporting Meloni press conference ↗

{{cite news |title=Italy bought Israeli Graphite spyware. Who hacked Fanpage's editor is still unknown |url=https://567politics.com/news/italy-paragon-graphite-spyware-copasir-cancellato-israel-november-2026 |work=567politics |author=567 Politics staff |date=2026-11-09 |language=en}}

{
  "id": "https://567politics.com/news/italy-paragon-graphite-spyware-copasir-cancellato-israel-november-2026",
  "type": "article-newspaper",
  "title": "Italy bought Israeli Graphite spyware. Who hacked Fanpage's editor is still unknown",
  "URL": "https://567politics.com/news/italy-paragon-graphite-spyware-copasir-cancellato-israel-november-2026",
  "container-title": "567politics",
  "language": "en",
  "author": [
    {
      "literal": "567 Politics staff"
    }
  ],
  "issued": {
    "date-parts": [
      [
        2026,
        11,
        9
      ]
    ]
  }
}

<iframe src="https://567politics.com/embed/news/italy-paragon-graphite-spyware-copasir-cancellato-israel-november-2026?theme=auto" title="Italy bought Israeli Graphite spyware. Who hacked Fanpage's editor is still unknown by 567politics" width="100%" height="440" style="border:0;max-width:100%" loading="lazy"></iframe>
<p style="font-size:14px">Italy bought Israeli Graphite spyware. Who hacked Fanpage's editor is still unknown by <a href="https://567politics.com/news/italy-paragon-graphite-spyware-copasir-cancellato-israel-november-2026" rel="nofollow">567politics</a></p>
<script async src="https://567politics.com/embed.js"></script>