Introduction

One of the biggest data breaches in Italy’s recent history has come to light, with several hotels becoming the target of hackers. In this incident, nearly 100,000 identity documents including passports and ID cards of guests were exposed and later found circulating on underground forums.

Following the breach, official advisories were issued by Italian authorities to guide organizations on next steps and preventive measures.

In this blog, we will look at how this breach may have happened, what the government’s response has been, and what both organizations can do to stay secure.

Timeline of the Breach

August 5, 2025

The first major listings appeared on underground forums. Hackers began offering tens of thousands of high-resolution identity document scans (passports, national IDs, visas) stolen from Italian hotel systems. The leaked files were in JPG, PNG, and PDF formats, making them easy to use for fraud.

August 6–10, 2025

Multiple new postings followed, with additional hotels targeted. In total, the malicious actor claimed to have stolen and listed over 70,000 new documents during this period.

By mid-August 2025, the scale of the incident had become clear. At least twelve hotels were confirmed to be affected, with close to 100,000 guest identity documents exposed in total. The attacker, who goes by the alias “mydocs”, claimed responsibility for the breach and stated that the data was obtained through unauthorized access to hotel systems between June and August 2025.

Government Advisories

On August 13, 2025, two official advisories were released:

CERT-AgID (Agency for Digital Italy)

On August 13, 2025, the Italian government stepped in with official advisories addressing the hotel data breaches. The Agency for Digital Italy (CERT-AgID) confirmed that identity documents from several hotels were being illegally sold online. According to their findings, tens of thousands of high-resolution scans of passports, ID cards, and other guest identification documents had been compromised.

The agency warned that this type of information could easily be misused for identity theft, fraudulent financial activities, the creation of fake documents, or social engineering attacks. To reduce risks, CERT-AgID urged citizens to keep a close eye on any unusual activities such as unauthorized bank account openings or unexpected loan applications. At the same time, trust service providers, including those managing SPID and digital signatures, were asked to strengthen their verification processes and remain vigilant.

GPDP (Italian Data Protection Authority)

The same day, the Italian Data Protection Authority (GPDP) also released a statement confirming that investigations were underway. The authority reminded hotels and accommodation facilities of their legal duty under GDPR to report data breaches and to notify affected guests when their personal information was at risk.

How Could the Breach Have Happened?

While the exact technical details of these breaches are not yet confirmed, there are several likely possibilities.

Unpatched Software : Hotels often rely on property management systems (PMS) and booking platforms. If these systems are outdated or not updated regularly, attackers can exploit known vulnerabilities.
Poor Access Controls : Sensitive files, such as ID scans, may be stored in unsecured folders or cloud buckets without strong authentication, making them easy targets.
Lack of Encryption : If identity documents are stored without encryption, hackers who gain access can steal the files in their original, high-resolution format.
Phishing Attacks on Staff : Employees may be tricked into clicking malicious links or giving away login details, giving attackers a way into internal systems.
Weak Data Retention Policies : Many hotels keep guest IDs and documents longer than necessary. Without automatic deletion, even old data remains accessible to hackers.

Impact & Risks

Identity Theft : Criminals can misuse personal details for impersonation or illegal activities.
Financial Fraud : Stolen documents may be used to open accounts, request loans, or carry out unauthorized transactions.
Travel & Legal Issues : Forged or duplicated IDs could cause complications for genuine travelers.
Social Engineering & Phishing : Victims may be tricked with highly targeted scams using their leaked information.

Staying Secure After the Breach

The Italian hotel data breach shows that both individuals and organizations need to take cybersecurity seriously. Here are three key steps that can make the difference:

Protect What You Collect

Hotels and businesses should only keep the personal information that is absolutely necessary. Storing full passport scans for a long time creates unnecessary risk. If the data isn’t needed anymore, it should be deleted. Less stored data means less for hackers to steal.

Secure Systems with Layers

A simple password is not enough to protect sensitive systems. Adding extra security steps like multi-factor authentication, using encryption, and keeping systems updated makes it much harder for attackers to succeed. Even if they get in, these protections limit what they can access.

Stay Alert and Aware

People should watch out for unusual financial activity, fake emails, or suspicious account openings. Reporting problems quickly can stop bigger damage. For organizations, regular monitoring, staff training, and following GDPR rules are key to keeping guest trust.

Final Takeaway

The Italian hotel data breach shows how quickly sensitive information can end up in the wrong hands. It’s a wake-up call for businesses to handle data more responsibly and for individuals to stay alert. In today’s world, protecting information isn’t just about compliance , it’s about trust. Staying secure is everyone’s responsibility.