From supermarket cold chains to blood donation services and the administrative backbone of Berlin, cyberattacks are striking critical infrastructure with alarming frequency. Marco Di Filippo, a cybersecurity expert at Whitelisthackers, describes the past fortnight as exceptional: “We have seen an extraordinary concentration of spectacular cases, more than we would normally encounter in an entire year.”
Di Filippo is an ethical hacker, hired by companies and public bodies to probe their digital defences before criminals can exploit them. His recent workload has been heavy: the leak of internal AfD documents, vulnerabilities in Revolut’s systems and the PHP scripting language used by countless websites, and attacks on cold storage facilities. Germany’s Federal Criminal Police Office recorded economic losses of €202.4 billion from cybercrime in 2025.
A single click opened Berlin’s doors
The August 2026 breach of Berlin’s state network stands out as a particularly instructive case. The attackers, a ransomware group known as Rhysida, demanded 30 bitcoin (roughly €2 million). The Berlin senate refused to pay, and 1.4 million confidential files were eventually published on the darknet.
The root cause was a human error. “The victim was lured to a website and asked to confirm they were human,” Di Filippo explains. This technique, called ClickFix, is familiar to many: you solve a puzzle or enter a code to prove you are not a bot. But on this occasion, the victim was instructed to press a specific key combination, paste a command, and hit Enter. “By doing that, they opened the door for the attackers themselves,” he says.
Di Filippo likens it to writing an email that says: “I want to rob a bank and I’ll come at ten this evening. Please leave the door ajar so I can go straight to the safe.” The case reveals two failures: a user who executed the command without thinking, and a system that granted that user far too many privileges. “We see cases like this every day where all you can do is shake your head,” he adds.
Humans are the weak link
The probability of being hit by a cyberattack is one in two, yet most people underestimate that risk. “People are more afraid of burglaries or thunderstorms,” Di Filippo notes. “The chance of being struck by lightning is just 1 in 200,000.”
He argues that security is often sacrificed for convenience. “Many products are sold with usability as the main focus,” he says. Smart homes allow remote control of lights and heating; supermarket fridges are connected to the internet for central management. Everything becomes easier, but not necessarily safer.
That convenience comes at a cost. “This is exactly where we have a deficit in our education today,” Di Filippo warns. “By ‘we’ I mean all of us – everyone who has never learned to recognise the dangers.” People who have never experienced an attack do not see themselves as targets, even though the opportunities for criminals to access devices are multiplying.
Why cybersecurity starts with education
Sometimes a single click on a link in an SMS or WhatsApp message, followed by a request to confirm your identity, is enough to give attackers access to your private messages. This method, known as “ghost pairing”, was flagged by Germany’s Federal Office for Information Security (BSI) earlier this year. The BSI advises users to scrutinise incoming messages and enable two-factor authentication.
Other countries are investing heavily in awareness. “When I travel on the underground in India, I see posters everywhere about cybercrime, with a hotline you can call,” Di Filippo says. In Germany, by contrast, victims are sometimes turned away by the police and have to search for the right authority.
“There are new angles and ideas for attacks every day,” he warns. “With the fridges, hackers found one security gap and now they just have to see who uses that model. The attacks then spread accordingly.” A single vulnerability can trigger a snowball effect.
Di Filippo estimates that in 80 to 95 percent of attacks, human action is what allows the breach to happen. “We have to focus very strongly on education and awareness so that we ultimately become resilient to cyberattacks. The human factor has to be included – we cannot manage it with technology alone.”
His work is about thinking like the enemy. “We try to attack infrastructures or find flaws in software and IT devices, using the same tools that real cybercriminals use.” The goal is to close the gaps before they are exploited. As recent attacks on Italian institutions show, no sector is immune. The EU agency has warned that AI is industrialising cyberattacks, shrinking the time defenders have to respond. For Di Filippo, the message is clear: cybersecurity is not just a technical challenge, but a societal one.
