The Uffizi cyberattack should worry every museum in Europe

This article was published on April 7, 2026 A cyberattack on one of Italy’s greatest cultural institutions reveals a sector that has mastered physical security and ignored the digital kind. On the weekend of 1 February 2026, staff at the Uffizi Galleries in Florence arrived on Monday morning to find their email accounts suspended, their internal servers unreachable, and the administrative backbone of one of the world’s most celebrated museums effectively dark. The malware had come in through a vulnerability linked to software managing low-resolution images on the museum’s website, a door so small that nobody had thought to lock it. Within hours, whoever was on the other end had moved laterally through the network connecting the Uffizi, Palazzo Pitti, and the Boboli Gardens, touching the photographic archive server and, according to the Italian daily Corriere della Sera, sending a ransom demand directly to the personal phone of director Simone Verde. The Uffizi’s official response was swift and categorical: nothing was stolen, no security systems were compromised, and the incident was “nothing like the Louvre.” That comparison, intended to reassure, may be the most revealing thing a