- Dark Reading, citing unreleased Intel 471 data, says Italy is about 7% of initial access sold on criminal forums, second to the United States at 30%.
- Dark Reading reports Italian access sales (Jan–Sep 2026) used flaws in 57% of cases, credentials in 23%. A separate 2025 global report shows 6.5% and 49%, possibly measured differently.
- The figures count listings on criminal forums, not all breaches. Leaders should check whether their own threat data hides a local pattern.
A country that does not fit the average
A common picture is that attackers steal passwords and log in. Intel 471's global 2025 data partly supports it: Dark Reading reports that 49% of broker listings advertised credentials as the attack type. But a global figure is an average, and an average can hide a place that behaves differently.
Italy may be such a place. Intel 471, a threat intelligence firm, puts it second worldwide and first in Europe by the number of break-in footholds offered for sale from January through September 2026. Ransomware crews also aim at Italy often. It sits fourth on the report's list of targeted countries.
The idea worth taking from this is modest. Italy shows that a global average can hide a very different local pattern. The sensible response is to check whether it does for you.
If a market runs on software flaws rather than stolen logins, that changes where money should go. This is our interpretation, not a finding of the report. Login protection still matters. But an inventory of what you expose to the internet, and how quickly you patch it, would carry more of the load.
What an access broker sells
An initial access broker breaks into an organization and then sells that foothold to someone else. Buyers are often ransomware groups. The broker does the first step. The buyer does the damage.
That makes broker listings a useful early signal. They show how criminals are getting in before a ransom note arrives. They do not capture every breach, only the access that was advertised for sale on forums.
Gianluca Tiepolo, a cybercrime analyst at Intel 471, told Dark Reading that Italy "kept appearing at the top" of the firm's monthly internal reports. That is why the team looked closer.
The numbers behind the outlier
Dark Reading saw the report before release. It says the data puts Italian organizations at about 7% of all initial access sold on cybercriminal forums, behind only the United States at 30%. Those two shares come from Dark Reading's account. Intel 471's public summary does not give them. Dark Reading also calls Italy the 25th largest country, without saying by what measure.
Dark Reading's account of the Italian data uses two separate cuts. One is how the foothold was obtained. The other is what kind of asset was sold. They describe different things, so they overlap and do not add up to 100%.
For Italy, January to September 2026: on how access was obtained, brokers used software vulnerabilities in 57% of cases. Credentials explained 23%. On the asset sold, victim-owned web infrastructure appeared in 49% of cases. Remote access and remote desktop tools made up 26%.
Dark Reading sets these against Intel 471's separate 2026 Cyber Threat Trends & Outlook report, which covers 2025 worldwide. It too has two cuts. On attack type, 49% of broker listings advertised credentials, and exploited vulnerabilities appeared in 6.5% of cases. On the asset targeted, remote access tools made up 67%. Web infrastructure was too small a share for Intel 471 to cite.
Treat the comparison with care. The Italian figures cover January to September 2026. The global figures cover 2025 and come from a different report. The sources do not say whether the methods match.
The definitions may also differ. The global 49% counts listings that advertised credentials as the attack type. The Italian 23% is described as the share of cases credentials explained. The global 67% and the Italian 26% both concern remote access, but the sources do not confirm they are defined alike.
How a software flaw becomes something to sell
This section is general background, not a finding about Italy. The sources do not say which products or flaws were involved.
Web infrastructure means systems that face the internet, such as a company's web application or web server. If one has an unfixed flaw, an attacker can sometimes use it to run commands or reach the network behind it. That foothold is the thing a broker can advertise.
A stolen login works differently. The attacker uses a real account and signs in like an employee. A flaw can give access without any account, so a second login step on user accounts may not close it. The usual defence against this route is knowing what you expose and keeping it updated.
What the sources leave open
Dark Reading reports that researchers cannot quite explain why Italy looks so different. It says they have three theories, but the available text does not set them out. We will not guess at them.
The Intel 471 summary also names the ransomware groups Qilin, The Gentlemen and LockBit 5.0. It describes demand for Italian-speaking callers in phone-based scams and sustained denial-of-service attacks by NoName057(16). It says the full report covers affected sectors and company sizes, which the public summary does not give.
Questions to put to your team
Start with exposure. Ask for a current list of systems reachable from the internet, with the owner and last update date for each.
Ask how fast an exposed system is patched once a flaw is public. Ask who is paged when it is not.
Ask which threat data your security program uses. If it is global, ask whether anyone has checked it against the countries where you operate.
Italy is one outlier, not proof that every region differs. But a single average can hide a very different local picture, and the cheapest time to find out is before a buyer does.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Intel471.
