When the IT systems of the Staatliche Kunstsammlungen Dresden suddenly failed in January 2026, it was not just one museum that faced a technical problem, but an entire network of fifteen museums. The digital attack paralysed internal processes, made it difficult to access collection data and forced those responsible to take rapid emergency organizational measures. While the physical works of art remained safe, it became clear how dependent modern museum operations have become on digital infrastructure. This was followed shortly afterwards by reports of similar incidents in Italy, including at the Uffizi Gallery in Florence, and finally even the Colosseum in Rome became the focus of security-related IT considerations.
These events are exemplary of a development that can be observed in many parts of the cultural world. Museums and archaeological sites are no longer just physical places of preservation, but highly networked organizations whose daily operations are based on digital systems. These range from ticketing and visitor management to climate control systems in exhibition spaces and complex databases in which research results, provenance and digital collections are stored. It is precisely this intertwining of culture and technology that makes institutions vulnerable to cyberattacks.
In the case of the Uffizi Gallery in Florence, it became particularly clear how complex the situation is in the area of conflict between digital and physical security. As the Italian daily newspaper “Corriere della Sera” reported, there was an attempt at blackmail in connection with cyber attacks on the institution in February. However, the museum management emphasized that key measures such as the relocation of the Medici Treasure were not taken in response to the cyberattack, but in connection with long-planned renovation work in the exhibition rooms. As a precautionary measure, parts of the collection were moved to a vault at the Bank of Italy in order to protect them as best as possible during the construction and remodeling phase. At the same time, additional camera surveillance systems were installed, but this had already been arranged after the spectacular break-in at the Lovre. Structural changes such as locking or bricking up individual entrances were also made in the context of fire protection requirements and general structural security measures and were not prompted by the cyber attack, as the museum emphasizes. Nevertheless, the temporal proximity of the events showed how quickly digital incidents are linked to physical protective measures in the public perception. The Colosseum in Rome also shows how much even iconic world heritage sites are included in this new threat picture. Although the focus here is less on the classic museum structure, the administration, visitor control and security coordination are also highly digitized. At the Colosseum, the ticketing system was affected. A cyber attack prevented tickets from being purchased via the official channels. This makes it clear that not only traditional museums but also archaeological monuments have become part of the same digital risk zone.
Diverse dangers
The forms of attack themselves are diverse and range from targeted phishing campaigns against employees to intrusion into networks through security gaps at external service providers and ransomware attacks, in which systems are encrypted and blocked in exchange for ransom demands. The theft of sensitive data is also playing an increasingly important role, especially when it comes to visitor information or internal security plans. In many cases, the material damage remains limited, but the organizational and reputational damage caused by a cyberattack can be considerable and affect operations for weeks. A particular challenge is that many cultural institutions have grown historically and their IT structures often consist of different generations of systems. At the same time, the pressure to digitize is increasing, for example through online collections, virtual exhibitions and data-based research. This development leads to a growing attack surface, while financial and human resources for cyber security often remain limited. This creates a tension between accessibility, modernization and protection.
The protection of cultural heritage must therefore increasingly also be understood as the protection of its digital infrastructure. Technical measures alone are not enough. Organizational resilience, trained employees and clearly defined emergency plans in the event of digital failures are just as important. Experience in recent years has shown that an attack on systems not only affects data, but can also have a direct impact on access to culture, research and the public. This makes it clear that cultural assets must be protected in a dual sense today. In addition to the physical preservation of objects, the digital integrity of the institutions themselves is taking center stage. Museums and historical sites are thus operating in a new field of tension in which the future of cultural memory is no longer decided solely in showcases and depots, but increasingly also in server rooms and networks.
