Italy’s famed Uffizi admits cyber-attack but denies security breach
Italy’s famed Uffizi admits cyber-attack but denies security breach
Florence’s Uffizi Galleries confirmed a cyber-attack but stated their security systems remained intact, safeguarding their iconic artworks. Hackers reportedly breached the museum’s IT network, accessing confidential security details, yet the Uffizi insisted no damage or theft occurred. The incident followed reports that intruders had infiltrated the museum’s digital infrastructure, allegedly retrieving access codes, internal layouts, and CCTV positions before demanding a ransom.
The museum contested claims that external access to its systems was achieved, emphasizing that its security frameworks were not compromised. Corriere della Sera described the attackers as having navigated through interconnected systems, including computers and phones, to compile a detailed operational map. A ransom message was sent to Simone Verde’s personal phone, threatening to expose the data on the dark web, according to the newspaper.
“There is no proof that the hackers had access to security maps,” the Uffizi said, noting that camera placements were visible to visitors, as with any public space, making their discovery unsurprising.
The Uffizi houses masterpieces like Botticelli’s Birth of Venus and Primavera. The attack, spanning late January to early February, affected the Uffizi and its affiliated Palazzo Pitti and Boboli Gardens sites. However, the museum later clarified the breach occurred specifically on 1 February.
Following the Louvre’s daylight heist in October, where thieves exploited outdated CCTV to steal priceless artifacts, major museums have reevaluated their security measures. The Uffizi claimed its situation was “nothing like the Louvre,” highlighting the replacement of analog cameras with digital systems after police recommendations in 2024.
While the museum acknowledged items were temporarily moved to a Bank of Italy vault, it maintained this was part of scheduled renovations. Corriere reported that some doors and emergency exits at Palazzo Pitti were sealed with bricks and mortar, and staff were instructed to avoid public discussion. The Uffizi countered that these closures were partly due to fire-safety upgrades, as the building had lacked certification for years. A notice was only submitted two days before the incident to the fire brigade.
“To limit the spread of movement within the historic structure’s spaces—dating back to the 1500s—given their altered uses and current global security landscape,” the Uffizi added.
Additional doors were sealed to “prevent excessive permeability of the historic building’s spaces,” the museum explained. It also addressed concerns about the digital photographic archive—a decades-long collection of artworks and documents—by stating the server remained undamaged due to a backup. While admitting the server was temporarily offline, the Uffizi said this was necessary for the backup to be restored, which was completed without data loss.
Despite the controversy, the Uffizi, Italy’s second-most visited museum after the Vatican, continues operations. Ticketing and public areas were unaffected, and the museum remains open to visitors. The Uffizi reiterated that employees’ phones were not compromised by the hack, reinforcing its stance on the security systems’ resilience.
