Hackers claim control of Venice's San Marco anti-flood pumps

Key Findings

• Threat actors claiming to be "Infrastructure Destruction Squad" or "Dark Engine" breached Venice's San Marco flood defense system in late March 2026

• Attackers claim to have maintained administrative access and stated they could disable flood defenses and inundate coastal areas

• Group offered full root access to the system for $600 USD, demonstrating both severity of breach and low barrier to further exploitation

• Italian authorities confirmed critical systems protecting Basilica di San Marco remained unaffected, but breach exposed vulnerabilities in strategically important infrastructure

• Incident reflects broader global trend of critical infrastructure exposure, with Iran-linked APTs simultaneously targeting internet-exposed OT systems across multiple sectors

Background

Venice's San Marco plaza sits at the intersection of tourism, history, and engineering. The area is protected by an advanced hydraulic pump system designed to prevent flooding and preserve one of the world's most iconic locations. This infrastructure represents the kind of operational technology that underpins modern civilization - systems built for reliability and longevity rather than adversarial resilience. When such systems were engineered decades ago, cybersecurity was not a primary consideration. That assumption is proving costly.

The Breach Timeline and Evidence

The attack began in late March when hackers gained access to the control interface. By early April, they started releasing proof - screenshots of control panels, system layouts, and valve states. The group announced their presence on Telegram in Chinese, making clear this was not a silent operation but a deliberate exposure. They claimed to have remained inside the network despite security checks and equipment tests conducted after Easter, suggesting persistent access and deep system knowledge.

The Threat Actor's Claims

In their Telegram announcement, the group stated explicitly that they had refused to fully shut down the flood defense system. Their message carried both technical competence and political intent. They warned that no security updates could expel them and threatened any media outlet reporting on the incident without "understanding the truth" with devastating attacks. The $600 asking price for root access seemed almost secondary to their primary goal: demonstrating vulnerability and delivering a message about Italian critical infrastructure weakness.

The Broader Context

This incident did not occur in isolation. On April 7, 2026, U.S. agencies including FBI, CISA, and NSA issued warnings about Iran-linked advanced persistent threats exploiting internet-exposed OT systems. These actors are targeting government services, water systems, and energy infrastructure globally, manipulating project files and altering data displayed on human-machine interfaces and SCADA systems. The convergence of information technology and operational technology, combined with remote access requirements and widespread legacy system deployment, has created conditions where adversaries operate with increasing capability.

The Fundamental Problem

Operational technology differs fundamentally from traditional IT systems. When compromised, the consequences extend beyond data loss to service disruption, economic damage, and direct threats to public safety. A flood defense system is not a database - disabling it results in physical water inundating a populated area. The technologies governing the physical world were never designed to withstand determined adversaries. They were built for uptime and reliability. That distinction now represents a critical vulnerability at scale.

Sources

• https://securityaffairs.com/190679/hacktivism/hackers-claim-control-over-venice-san-marco-anti-flood-pumps.html

• https://x.com/hackplayers/status/2043328303809937711

• https://x.com/Dinosn/status/2043332728628597044

• https://x.com/shah_sheikh/status/2043327685082878179

• https://news.ycombinator.com/item?id=47742902