Chinese-Linked APT Group Salt Typhoon Suspected in IBM Italy Subsidiary Breach In late April 2026, Italian cybersecurity authorities detected a significant breach at Sistemi Informativi, an IBM Italy subsidiary that manages IT infrastructure for critical public and private institutions. The incident, first reported by La Repubblica, has raised alarms over the expanding reach of Chinese-linked cyber operations in Europe. IBM confirmed the attack, stating it had "identified and contained a cybersecurity incident" and restored affected systems, though details on the breach’s scope remain undisclosed. The company’s website was temporarily taken offline during containment efforts. Multiple intelligence sources suggest the China-associated advanced persistent threat (APT) group Salt Typhoon is behind the attack. If confirmed, this would mark one of the most ambitious cyber intrusions targeting Italy’s public infrastructure in recent years. Active since at least 2019, Salt Typhoon has intensified its operations over the past two years, specializing in supply-chain attacks and zero-day exploits. The group is known for its technical precision, avoiding broad phishing campaigns in favor of infiltrating networks through vulnerabilities in widely used systems, such as Citrix and Cisco. Recent targets include Viasat, Canadian telecom firms, the U.S. Army National Guard, and Dutch government networks all characterized by prolonged data exfiltration and silent reconnaissance. As a key IT provider for Italian institutions, Sistemi Informativi’s compromise could expose sensitive data and critical infrastructure connections, enabling attackers to map and potentially disrupt national digital systems. The breach underscores a growing vulnerability: third-party IT providers serving as high-value targets, where a single compromise can grant access to multiple government and private-sector networks. The incident reflects broader trends in cyber warfare, where state-linked APTs increasingly exploit supply-chain weaknesses and AI-driven tactics to infiltrate critical infrastructure. For Italy and Europe, the attack highlights the need for stronger defenses and enhanced coordination between governments, industry, and intelligence agencies.