In short
According to ACN's Operational Summary, there were 181 ransomware attacks on Italian organisations in H1 2026, compared with 206 in 2025 (-12%).
12% hit critical entities, 36% medium-criticality entities and 51% lower-criticality entities: it is not just a problem for large companies.
The sectors most affected by ransomware were manufacturing, retail and technology.
According to ACN, attackers get in mainly through compromised credentials, unprotected remote access or VPNs and known vulnerabilities.
The priority defences are MFA, patching, separate backups with tested restores, training and a response plan covering the required notifications.
In July 2026 Italy's National Cybersecurity Agency (ACN) published its Operational Summary for the first half of 2026, the report setting out CSIRT Italia's operational data. According to ACN, 181 ransomware attacks against Italian organisations were recorded in the first six months of the year, compared with 206 in the same period of 2025: a 12% drop. The Agency warns, however, that ransomware remains one of the threats with the greatest impact on victims' operational continuity and on the confidentiality of information.
In this article we look at exactly what the ACN document reports, how to read the figures without jumping to conclusions and, above all, which defences make most sense for an SME. The starting point is simple: ACN also explains how attackers get in, and those entry points can almost always be closed with basic measures applied consistently.
What the ACN Operational Summary for the first half of 2026 says
The Operational Summary is a document ACN publishes every month and, as a summary edition, every six months. It gathers figures and indicators from the Agency's operational activities and compares them with the same period of the previous year. CSIRT Italia, ACN's technical and operational arm, is the national hub for incident notifications required by law, including those under NIS2.
The document states that the data reflect the analysis available at the time of writing and may be updated with new evidence. It is an important detail: these are official figures, but not final ones.
The ransomware figures
According to ACN, there were 181 ransomware attacks against Italian organisations in the first half of 2026, compared with 206 in the first half of 2025. That is a 12% fall, but the Agency adds a caveat: ransomware remains one of the threats with the greatest impact on continuity.
The report breaks victims down by criticality. 12% of ransomware attacks hit critical entities, 36% hit entities of medium criticality and the remaining 51% hit other entities of lower criticality.
Open-source monitoring also identified 137 ransomware attack claims against Italian organisations. ACN points out that claims are not always confirmed by the organisation concerned, so this figure should be read as an indicator, not as a count of victims.
The most affected sectors
For ransomware, ACN names manufacturing, retail and technology as the most affected sectors. Looking at all cyber events in the half-year, not just ransomware, the most affected sectors were manufacturing, technology and healthcare, while central and local public administration was less affected than in the first half of 2025.
Manufacturing appears in both rankings. For a manufacturing SME this is a signal to take seriously: a systems outage often means production lines and deliveries stop, not just unreachable email.
How attackers get in, according to ACN
This is the most useful part of the document. According to ACN, the main enabling factors behind ransomware compromises are three:
the use of previously compromised valid credentials;
the exploitation of remote access services or VPNs that are not adequately configured or protected;
the exploitation of known vulnerabilities and internet-facing services.
More generally, for all malicious activity in the half-year ACN identifies the most frequent entry points as malicious email campaigns, compromised valid credentials, phishing and social engineering. The Agency stresses that a significant share of attacks exploits behaviours and processes: opening malicious attachments or links, entering credentials on fraudulent portals, reusing passwords, not using strong authentication, and dealing late with compromised accounts. In some cases attacks followed supply chain patterns, with suppliers' security becoming a source of exposure for their customers.
How to read the figures without misinterpreting them
In the same half-year ACN counted 2,171 cyber events, compared with 1,474 in the first half of 2025 (+47%). It looks like a surge, but the Agency explains that the growth is mainly due to the more than 1,000 NIS notifications received by CSIRT Italia after the notification obligations came into force. According to ACN, the figure should not be read as a real increase in the threat, but as a greater ability to detect events that previously might not have come to light.
The same applies, in reverse, to the fall in ransomware: a 12% drop is good news, but it does not mean the risk for your company has fallen. Here are the report's main figures at a glance.
Indicator (source: ACN, Operational Summary H1 2026) | H1 2026 | Comparison with H1 2025 |
|---|---|---|
Ransomware attacks against Italian organisations | 181 | 206 (-12%) |
Share of ransomware attacks on critical entities | 12% | not stated |
Ransomware claims (open sources) | 137 | not stated in the text |
Total cyber events | 2,171 | 1,474 (+47%, mainly due to NIS notifications) |
Incidents with confirmed impact | 1,072 | up |
What these figures mean for an SME
The first message is that ransomware is not just for large companies. With half of attacks aimed at lower-criticality entities, the idea of being "too small to be of interest" is not borne out by the data. ACN does not give the size of victims, but the breakdown by criticality is enough to show that the problem affects organisations of every kind.
The second message is more encouraging: the entry points described by ACN are basic gaps, not attacks that cannot be prevented. Stolen and reused credentials, remote access left open, unpatched systems, deceptive emails. These are all areas where an SME can act with reasonable resources, as long as it does so in an orderly and continuous way.
The third message concerns the supply chain. If you supply larger companies or organisations within the scope of NIS2, your security is part of their security. It is no coincidence that customer security questionnaires increasingly ask about backups, MFA and vulnerability management.
The defences that really matter
The measures below are the ones that respond directly to the enabling factors identified by ACN. None of them on its own makes a company invulnerable: the aim is to reduce the likelihood of a successful attack and limit the damage if it happens. For a broader picture, see our dedicated guide to minimum cybersecurity measures for SMEs.
Separate backups and tested restores
Ransomware aims to make data unusable, and often backups reachable from the network too. That is why you need at least one copy kept apart from the production network: offline, on a disconnected medium, or in a store that cannot be modified or deleted for a set period. Copies should also be protected with credentials different from everyday ones.
A backup that has never been restored is a hope, not a guarantee. In its advice for SMEs, ACN recommends periodically testing a full restore, giving priority to critical data. Also measure how long it really takes to get back up and running: that figure will tell you whether the backup is enough or whether you need a continuity plan.
MFA and credential management
Since compromised valid credentials are the first enabling factor identified by ACN, multi-factor authentication is the defence with the best effort-to-benefit ratio. ACN recommends enabling it wherever possible, especially on email, cloud storage, privileged accounts and remote access.
Alongside MFA you need strong, non-reused passwords, a company password manager and a procedure to disable accounts immediately when people leave or when compromise is suspected. ACN specifically mentions slow handling of compromised accounts among the behaviours that make attacks easier.
Patching and reducing exposed services
Exploitation of known vulnerabilities is the third enabling factor. The answer is an update process with clear priorities: first internet-facing systems and those with actively exploited vulnerabilities, then the rest.
The second step is to shrink the attack surface: every internet-facing service you do not really need is one more door. Take an inventory of what can be reached from outside and close whatever is unnecessary. A periodic vulnerability assessment helps you see it through an attacker's eyes; to choose the right test, read our guide on penetration testing and vulnerability assessment.
Remote access and VPNs
ACN explicitly mentions remote access services or VPNs that are not adequately configured or protected. For an SME this means three things: mandatory MFA on all remote access, VPN software always up to date, and no remote desktop exposed directly to the internet.
Be careful with supplier access too: ACN recommends limiting it to what is strictly necessary and defining it in contracts. Maintenance access left permanently enabled is exactly the kind of door an attacker looks for.
Segmentation and least privilege
Once an attacker is in, the damage depends on how far they can move. Splitting the network into zones (offices, production, servers, guests, backups) limits propagation and protects the most important systems. In manufacturing companies, separating IT and production networks deserves particular attention.
The same goes for privileges. ACN advises against giving users administrator rights on their own computers and recommends limiting privileged accounts to the people who really need them, who should use an ordinary account for daily work.
Anti-phishing training and a reporting culture
Malicious emails, phishing and social engineering are among the most frequent entry points according to ACN, which explicitly speaks of the central role of the human factor. Training works when it is short, frequent and practical: real examples, phishing simulations, clear instructions on what to do.
The most important point is reporting. An employee who clicked a suspicious link and says so straight away makes it possible to act in time; one who fears being told off stays silent. Set up a simple reporting channel and thank people who use it.
Suppliers and the supply chain
ACN reports attacks following supply chain patterns and incidents at IT service providers whose effects spread to several organisations. Ask your critical suppliers what measures they apply, include incident clauses in contracts and check who has access to your systems and with what permissions.
Enabling factor identified by ACN | Priority defence | Further reading |
|---|---|---|
Compromised valid credentials | MFA, password manager, fast account revocation | |
Unprotected remote access or VPN | MFA on all remote access, updates, limited supplier access | |
Known vulnerabilities and exposed services | Prioritised patching, inventory of exposed services, periodic testing | |
Malicious email and phishing | Training, simulations, reporting channel | |
Impact on operational continuity | Separate backups, restore tests, continuity plan |
What to do now: a checklist for the coming weeks
This is a realistic sequence for an SME. You do not need to do everything in a day: you need to assign each item to a person with a date.
Check that at least one backup copy is kept apart from the network and try restoring a critical system.
Enable MFA on email, cloud, VPN and administrator accounts, starting with those with the most privileges.
List the services reachable from the internet and close those that are not needed.
Check the update status of firewalls, VPNs, servers and exposed systems, and subscribe to CSIRT Italia alerts.
Review suppliers' remote access and disable any that are no longer used.
Run a short anti-phishing session and tell everyone how to report a suspicious email.
Write on a single page who to call in an incident: internal lead, IT supplier, legal adviser, DPO if you have one.
If it happens: response, continuity and notifications
Even with good defences, no company can completely rule out an incident. Preparation makes the difference: knowing who decides and what to do in the first hours reduces damage and mistakes.
The first hours
The response plan should at least state who coordinates, how affected systems are isolated from the network, who contacts the IT supplier and how evidence useful for the analysis is preserved. Avoid wiping or reinstalling everything on impulse: the traces are needed to understand where the attacker got in and whether data was taken. ACN recommends defining roles and contacts in advance and running regular incident-handling exercises.
Notifications
Ransomware that hits personal data is almost always also a personal data breach under the GDPR: loss of availability alone counts as a breach. In that case Article 33 requires the controller to notify the supervisory authority (in Italy, the Garante) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. The examples in the EDPB guidelines show that the assessment changes a great deal depending on whether adequate backups exist and whether data was exfiltrated. All the steps are explained in our guide to the first 72 hours after a data breach.
If your company falls within the scope of NIS2, check the obligations under Italian Legislative Decree 138/2024: for significant incidents there is an early warning to CSIRT Italia within 24 hours, a notification within 72 hours and a final report within one month. The two notifications, GDPR and NIS2, are separate and do not replace each other. If you are outside NIS2, CSIRT Italia still provides a channel for reporting a cyber incident.
Operational continuity
The real cost of ransomware is often the downtime. That is why technical defences need to sit alongside a continuity plan: which processes are vital, how quickly they must be restored, how much data you can afford to lose, how to work in a reduced mode. Setting realistic RTOs and RPOs and checking that backup and restore meet them is the link between security and continuity. You will find a step-by-step approach in our guide to business continuity planning for SMEs.
In the medium term: from individual measures to a system
The measures in the checklist deliver quick results, but they tend to decay: access opened for an emergency and never closed, an update postponed, a backup that stops working without anyone noticing. To keep them in place over time you need a management system.
ISO 27001 is the international standard for an information security management system: it starts from risk assessment and requires you to select appropriate controls, assign responsibilities, measure and improve. Backups, access control, vulnerability management, training, suppliers and incident management are all control themes in Annex A. If your company also has to deal with NIS2, our guide on ISO 27001 and NIS2 explains how the two fit together.
Alongside the system you need periodic external checks. A web application penetration test shows whether exposed services can actually be exploited, while ISO 22301 structures operational continuity with a recognised method. They are not obligations for everyone: they are tools to choose according to your risks and customer requirements, on a proportionate path for your business.
How Complaion helps with information security and NIS2
Complaion supports companies with information security and with the certifications that make it verifiable. A dedicated Lead Auditor starts from where you are, checks what you already have and what is missing, and proposes the route that suits you best among ISO 27001 certification, NIS2 compliance and ISO 22301 for business continuity.
The platform gathers the evidence, manages policies and procedures, keeps the schedule of controls and gets you ready for the audit. The Lead Auditor also conducts the internal audit, so you know whether the measures work before any external check. On the technical side you can add a penetration test.
More than 1,000 clients have already chosen Complaion. If you want to work out where to start, get in touch.
Frequently asked questions about ransomware in Italy
How many ransomware attacks were there in Italy in 2026?
According to ACN's Operational Summary for the first half of 2026, 181 ransomware attacks against Italian organisations were recorded in the first six months of the year, compared with 206 in the same period of 2025, a 12% drop. ACN warns that the data may be updated with new evidence. For the second half of the year, refer to forthcoming ACN reports.
Does the fall in ransomware mean the risk has decreased?
Not necessarily. The number of recorded cases has fallen, but according to ACN ransomware remains one of the threats with the greatest impact on operational continuity and the confidentiality of information. For an individual company what matters most is whether the main entry points are closed: credentials, remote access, known vulnerabilities.
Which sectors are most affected by ransomware in Italy?
In the first half of 2026 ACN named manufacturing, retail and technology as the sectors most affected by ransomware. Across all cyber events, the most affected were manufacturing, technology and healthcare. The manufacturing sector appears in both rankings.
What is the most effective defence against ransomware for an SME?
There is no single measure. The defences with the best effort-to-benefit ratio are multi-factor authentication, updates to internet-facing systems and a backup copy kept apart from the network with a tested restore. Together they address the enabling factors identified by ACN and limit the damage if an attack succeeds.
Does a ransomware attack have to be notified to the data protection authority?
If it affects personal data, usually yes: loss of availability alone is a personal data breach. Notification is due within 72 hours of becoming aware, unless a risk to people is unlikely, and the assessment depends on factors such as backups and any exfiltration. If you fall within NIS2 there is also a notification to CSIRT Italia, separate and with its own deadlines.
Does ISO 27001 protect against ransomware?
No certification makes a company immune. ISO 27001 does, however, require you to assess risks, select appropriate controls and check them over time, and many of those controls concern backups, access, vulnerabilities, training and incident management. Its value lies in keeping defences active and documented, year after year.
