Breaches and incidents
Muggio municipality (Italy): hijacked mailbox session used to send fake payment notices
The Comune di Muggio says that between 12:14 and 12:46 on 28 Sep 2026 fraudulent emails with the subject “Avviso di pagamento” were sent to external...
- Disclosed
- Verification
- Checked against a primary source
What happened
- The Comune di Muggio says that between 12:14 and 12:46 on 28 Sep 2026 fraudulent emails with the subject “Avviso di pagamento” were sent to external recipients from a municipal mailbox, which contains copies of identity documents, bank details (IBAN) and cadastral references.
- Root cause per the municipality: an unauthorized party “obtained an access session for the mailbox” and created a mail rule to divert replies to another folder.
- No attacker named.
- The account was blocked and active sessions revoked; the incident was reported to the Garante privacy authority and CSIRT Italia and a complaint filed with law enforcement; citizens were told official tax notices never contain hyperlinks.