Reception gets a call asking when an executive will leave the office. The caller knows the executive’s personal number and mentions an appointment the following day. Soon afterwards, the executive’s office receives a message mentioning the same appointment. If the two incidents are logged separately by different departments, it is hard to tell whether they warrant attention. Looking at them together helps the company decide what to verify and who should act.
On 7 November 2026, Italy’s Ministry of Foreign Affairs announced that cybersecurity teams had detected the circulation of Foreign Minister Antonio Tajani’s personal data on the dark web in the preceding days. The ministry said Tajani had linked the threats to Italy’s support for Ukraine. The Associated Press reported the incident and attributed the reference to pro-Russian hackers to Prime Minister Giorgia Meloni. That same day, Italy’s data protection authority warned media outlets and platforms about the risks of obtaining and republishing data derived from unlawful activity, including when it concerns public figures. [1] [2] [3]
On 9 November, ANSA reported that Rome prosecutors had opened an investigation into the publication of the data and requests for information posted on the dark web. The investigation is under way. When the data first appeared, how it was obtained and who published it remain open questions. [5]
Start with the information the company publishes
A review can begin with material the company controls directly, including its website, press releases, event flyers and photographs, and downloadable documents. A conference programme can reasonably say when a speaker will take the stage. Travel times, private mobile numbers and instructions for accessing the premises can stay in channels restricted to event organisers. Ask who needs each piece of information to do their job.
Include pages published by organisers and partners, particularly when they reuse old presentations or biographies. A simple list can record the page, the category of information, who can address it and when it was reviewed. If personal contact details appear on company channels, record where they appear and assign the correction without copying the details into a shared spreadsheet. The UK National Cyber Security Centre’s guidance for people at higher risk recommends checking how much personal information is visible on social media and to whom. It also points out that private accounts can be targeted. [4]
Keep incident reports within the team handling them
Reception, the executive’s office, communications and security should have a common contact for reporting unusual requests. Someone who receives a call can record the time, what the caller asked for and any appointment mentioned. Someone who receives a message should preserve it in the designated company channel and keep it out of group chats. If a report contains private data or points to material distributed unlawfully, the person handling the case should decide what to preserve and how.
To set priorities, separate what can be verified from what someone merely claims. A post repeating contact details already on the website, a message mentioning a confidential appointment and a threat naming a place and time call for different checks. If people are in immediate danger, contact the authorities and activate internal security procedures. Checks on the origin of the data can follow.
Over the following days, the company can check whether the requested removal has taken place, whether the same information remains visible on channels it manages and whether further reports have come in. If several departments are involved, a timeline shared only with those handling the case can reveal overlaps and gaps without assuming that all the contacts came from the same source.
GRISK can help a company verify through lawful sources what information about its executives is exposed and assemble a documentary record of relevant reports.
Sources and editorial note
- Italian Ministry of Foreign Affairs and International Cooperation, statement on Tajani’s data circulating on the dark web, 7 November 2026. https://www.esteri.it/it/sala_stampa/archivionotizie/comunicati/2026/11/tajani-dati-personali-diffusi-sul-dark-web-chiesto-di-trattare-minacce-ibride-al-prossimo-g7-esteri-solidarieta-a-lo-voi-gabrielli-e-tassan-zanin/
- Associated Press, report on Prime Minister Meloni’s statements about the leak, 7 November 2026. https://apnews.com/article/italy-minister-tajani-cyberattack-41b956d638e95528bef84fd856d5b5d6
- Italian Data Protection Authority, statement warning the media about the Tajani case, 7 November 2026. https://www.gpdp.it/home/docweb/-/docweb-display/docweb/10318166
- UK National Cyber Security Centre, Cyber Security for High-Risk Individuals, 2024, consulted on 8 November 2026. https://www.ncsc.gov.uk/files/Cyber-security-high-risk-individuals.pdf
- ANSA, report on the opening of the investigation, 9 November 2026. https://www.ansa.it/sito/notizie/cronaca/2026/11/09/al-via-unindagine-sui-dati-di-tajani-nel-dark-web.-allarmi-bomba_217a25ea-2d5f-432d-98ba-51fd3560f4ca.html
The Ministry of Foreign Affairs says the circulation of the data was detected in the days before its 7 November announcement and gives no date for its first appearance. ANSA reported the opening of the investigation on 9 November. The opening scenario is hypothetical and the organisational measures are editorial assessments. The NCSC guide provides general guidance.