In recent weeks the site of Ministry of Defense (difesa.it) was subject to an increase of accesses on the part of Chinese IPs. The traffic boom from the “dragon” began on December 23, 2025 and remained sustained throughout the recent holiday period, with a peak of 1,200 accesses on a single day and an average of 900 over the past week. As reported by Difesaonline.itwhich cites a survey conducted by The Sheetover 7,000 of these accesses concerned the section Transparent Administrationin which various significant data are available for a hypothetical operation intelligence. Among them, for example, the hierarchical and functional structure of various departments, such as the National Armaments Directorate; tender notices; contracts with technical specifications of the equipment (come on bulletproof vests to generators); balance sheets; asset management and more. There are also accesses relating to the sections on Italian missions abroad and on the activities of the Minister of Defense Guido Crosetto.
It is important to underline that all this information is freely accessible to anyonefor reasons related to the transparency of thepublic administrationbut this does not mean that they cannot be considered “sensitive”, especially if searched with some strategic objective by other countries. The so-called intelligence from open sources or OSINT (acronym for Open Source Intelligence), moreover, is an important branch of intelligence linked precisely to the collection and analysis of data and information open to the public, accessible to anyone. We are therefore not faced with a hacker attack or the theft of confidential information.
The implementation ofartificial intelligence it has made OSINT operations much more efficient, allowing the “harvesting” of an enormous amount of significant, albeit freely available, data. To give a practical example, analyzing the contracts relating to the purchase of body armor for the army, a third country may know how the soldiers and adjust accordingly. It is just a banal example of the multitude of valuable information that similar databases can offer to those interested. It is the price to pay for transparency and democracy, although it is always possible to protect them to at least filter who can consult them.
Attack on ChatGPT, what data was stolen from Mixpanel and what users risk
As explained by Il Foglio, the increase in access from Chinese IPs to the Ministry of Defense was assessed as persistent from the Matomo software, previously known as Piwik and similar to the more famous one Google Analytics (but more privacy oriented). With this platform, for example, it is possible to determine the number of visits, the most visited pages, the keywords searched for, browsing behavior and where the accesses come from. It is necessary to underline that through VPN and other computer systems the geolocation it is not imprinted in fire, therefore there is no certainty of being faced with an intelligence operation by Chinese government apparatus. It is not even certain whether these consultations were done by people or by bot to automatically extract data from the website (scraping).
What is certain is that during the holiday period the attention threshold – so to speak – is lowered and it is the ideal time to conduct intelligence analysis from open sources. It could also be one preliminary evaluation before launching a cyber attack, as suggested by the experts consulted by the newspaper, or an intelligence operation carried out openly with the same purpose as the “announced” military exercises. However, the signal of this anomalous increase in access is not underestimated and the government is moving to investigate the issue further.
