FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
At least one matching recordNo matching recordSelected country
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
15 high school students suspended after altering grades on register in Italy
In December 2019, teachers at a high school in Italy noticed that grades on the register did not match the ones they had given. The suspected students were called in and confessed; 15 students were suspended with the obligation to attend lessons and were reported to the postal police for unauthorised access (an allegation). Teachers first noticed the discrepancy. Responses acted on the students. Whether register access security was changed is not stated in the source.
15-year-old boy in Italy allegedly altered grades on the electronic register; Ministry says its own systems were not breached
A 15-year-old boy is alleged to have changed grades, turning 5s into 6s, from his home in Italy, and to have interfered with tanker routes in the Mediterranean; he was identified through an investigation coordinated by the Polizia Postale and the prosecutor and was reported (an allegation). The Ministero dell'Istruzione e del Merito said checks showed no access to its own systems, that the case most likely involved the electronic register, and that each school chooses and contracts its register supplier autonomously. The Ministry said it was in contact with the Polizia Postale and urged schools to keep attention on digital security. Who first noticed is not stated in source beyond a complaint that opened the file. Whether the register was changed is not stated in source.
34 high school students tried for altering attendance and grades on register using stolen teacher passwords
In the 2015/2016 school year, students at a high school in the Marche region, Italy, used stolen teachers' passwords to change attendance and grades on the school register. The high number of changes made the teaching staff suspicious. The school head reported the incident to the postal police, whose investigation identified 23 girls and 11 boys.
Activists project slaughterhouse footage to primary school pupils during classroom talk booked as animal welfare lesson
Members of the activist group Anonymous for the Voiceless, invited by email for an educational talk on animal welfare, connected computers in a primary school classroom in Sardinia, Italy, and projected graphic footage of industrial slaughterhouses and intensive farming. According to the report, many children cried, showed distress and tried to close their eyes, and teachers removed the group from the building. The head teacher said the school had been deceived, and a parent who is a municipal councillor said he intended to file complaints.
Ads, games and paid partner services inside the ClasseViva register app (“MyTools”)
A parent of a high-school student in Italy first raised the issue, and a national newspaper published an investigation in March 2025 showing the MyTools section held games, links to commercial sites and paid services such as student loans and study trips. The Minister of Education called it unacceptable, and in April 2025 the Ministry sent all schools and regional school offices a circular barring marketing, transfers of data to third parties, mini-games and ad banners in registers, and requiring register data to be portable. Spaggiari made the partner services unavailable until each school re-confirmed its consent, keeping only educational content. The responses acted on the company and its tool, and on every school nationally. The source says the tool was changed.
Child sexual abuse video forwarded into middle school class chat from an online game chat
A child sexual abuse video reached a middle school class chat after a pupil forwarded material received in a game chat. The judicial authority ordered the content to be deleted from all the phones of the children involved, restoring the devices to factory settings.
Children aged 7 to 8 reach pornographic sites on unfiltered PCs in an Italian primary school computer lab
During a supervised lesson, pupils in a primary school in Italy typed a search term into school PCs that had no filter and, as some pupils later reported, saw pornographic and fetish images; the teacher believed blocking was active. The parents' group Moige said it would ask the Ministry for an inventory of school IT security, and the Ministry said supplier choice, installation and maintenance are the responsibility of head teachers. Parents mobilised to find out what happened. Who first noticed is not stated in source beyond pupils later describing it. Whether a filter was installed afterwards is not stated in source.
Class WhatsApp chat used by six students to post sexual content and insult teachers
A WhatsApp class chat at a secondary school in Italy was used to post pornographic videos, extremist content and insulting videos of teachers. Six students were reported and suspended.
Compulsory iPad policy at a school in Apulia, Italy; families told to transfer if they do not purchase device
Parents objected to a circular stating that students without an iPad should continue their studies at another school, with devices required from the third grade of primary and the first year of lower secondary school. The female school principal defended the policy, citing the national digital school plan's "Bring Your Own Device" action, and stated that the school lends devices to foreign and lower-income families. Whether the requirement changed is not stated in the source.
Exposure of Minor Student’s COVID-19 Status via School Electronic Register
A minor male student at a school in Italy had his private medical information regarding a positive COVID-19 test exposed to his classmates and their parents. A teacher at the school sent the notification and the official public health document containing the minor's identity via the school's electronic register. The incident led the student's father to file a formal complaint with the Italian Data Protection Authority (Garante), which subsequently investigated and issued an official warning to the school for unlawful data communication.
Source: Garante per la protezione dei dati personali
Exposure of student’s special education and health details on school electronic registry portal
An administrative assistant at a high school in Italy made a selection error on the school's electronic registry portal, accidentally publishing a confidential meeting notice to all parents of a class instead of only the target student's parents. As a result, the female student's sensitive personal and health-related data, including her special education status and references to her Individualized Education Plan (PEI), were exposed to the families of all her classmates for several days. Following an investigation, the Italian Data Protection Authority (Garante Privacy) formally admonished the school for the unauthorized disclosure of health data.
Source: Garante per la protezione dei dati personali
Families required to buy a EUR 600 Apple iPad for a digital classroom section at a high school in Italy
Parents, speaking through a parent class representative, objected that they were told two weeks before term ended that staying in the digital classroom section required buying an iPad at about EUR 600, on top of EUR 300 to 400 for books. The school head defended the Apple choice as hard for students to modify during tests, and said families could move to the traditional section or change schools. The article says the school appeared to intend co-funding tablets for students in difficulty.
High school teacher suspended for not using electronic register when school supplied no device; court annuls sanction
In March 2015, a head teacher at a high school in the Apulia region of Italy found that a female teacher was keeping a paper register because the school had not provided teachers with electronic devices, and suspended her for one day. The teacher appealed with a lawyer from a teachers' union. On 16 February 2018, a local labor court annulled the sanction, finding no proof that the teacher had a device to fill in the register, and noted that teachers received tablets only after the disciplinary charge.
Intruders broadcast obscene and violent images into a middle school’s online English lesson in Italy
In March 2020, intruders entered a teacher's online English lesson at a middle school in Italy and sent pupils obscene and violent images; the students disconnected, visibly upset. Class representatives reported it to the head teacher and the postal police, and a class representative criticised access by a simple link with no authentication. Parents asked the head to inform all families of the security standards the school had adopted for distance learning, and the source says the Ministry and the regional school office were looking into the case. Families first raised it. Responses acted on the school and the persons responsible (police complaint, still an allegation). Whether access settings were changed is not stated in source.
Middle-school students compromise teachers’ electronic register credentials to alter grades, Italy
Middle-school students in Italy obtained the register passwords of at least four teachers and made at least 40 unauthorized accesses, turning failing grades into top marks and giving high-achieving classmates very low grades. A teacher noticed an anomalous low grade recorded for a usually strong student, which triggered an internal investigation. At publication, the school had taken no measures and filed no complaint, deferring decisions to class councils in April. Action against the students involved remains pending, and it is unstated whether register access controls were changed.
Ministry note bars homework posted on the electronic register in the evening or at weekends
Students reported through repeated surveys on a student portal that homework kept arriving via the electronic register, email or chat after school hours: 62% said it happens often, 14% said it is the norm, and 54% received homework digitally after lessons ended in June. On 28 September 2026, the Ministry of Education sent schools a note, in force for 2026/2027, requiring homework to be set in class before lessons end and ruling out register entries in the late afternoon, evening or at weekends that force students and families to keep checking for updates. It also asks heads to plan tests collegially and to favour students' disconnection from digital devices. The response acts on all schools and on how teachers use the tool. Whether register software settings were changed is not stated in source.
Nude images of two 14-year-old schoolgirls generated with app and shared in school chats
Manipulated nude images of two students created with the Bikinioff app were circulated among schoolmates. Police seized phones and a juvenile inquiry was opened.
Pornographic video broadcast into a primary school’s online open day in Italy
In January 2021, intruders joined an online open day for a primary school in Italy, which was accessed via a public link, and broadcast a pornographic video and blasphemous audio to teachers and prospective families. Organizers could not remove the intruders, so everyone left the meeting. The female head teacher reported the incident to the postal police to trace those responsible. The response acted on the persons responsible via a police complaint.
Ransomware takes down Axios electronic register used by about 40% of schools
Axios Italia, supplier to about 40% of Italian schools, reported a ransomware attack starting 3 April 2021 that left many schools without their register as in-person lessons resumed. The company told teachers and staff to use an emergency register, said it expected to restore service, and said its checks so far showed no data stolen. The company first noticed and reported it.
Register password spread through student chats; about 40 students changed entry times and absence justifications, Emilia-Romagna, Italy
After an upper secondary school student obtained the password to the school's electronic register, the password spread quickly through student chat groups. Approximately 40 students used the access to modify their school entry times and absence justifications. The students faced potential suspension and potential criminal complaints for unauthorized access to the school's system. It is not stated in the source who first noticed the breach. The school's response was directed at the students; the source does not state whether the password or access controls were updated.
Repeated intrusions with pornographic and violent videos into online lessons at an Italian high school; head warns parents
Anonymous intruders repeatedly entered online lessons at an upper secondary school in Tuscany, Italy, talking over the teacher and showing extremely violent films and pornographic videos; students disconnected on teachers' instructions, and smaller episodes occurred in other regional schools. The school head informed local postal police and law enforcement, and wrote twice to parents, the second time after a further intrusion in March, warning that the intruders needed a student to share the lesson link and that students who did so risked a criminal complaint.
School answered two teachers’ union complaints in one certified email, disclosing one teacher’s health information
At a school in Italy, two teachers filed separate union complaints about class assignments on the same day, and the school answered both with a single document sent in one certified email. The document contained health information about one teacher.
School app exposed child to games and YouTube content without parental awareness
A parent discovered that a school-provided application used for communication, homework, and school information also included games and direct links to YouTube videos. The parent reported being unaware these features existed within the student's version of the app. The consequence was unexpected exposure to non-educational content and lack of parental awareness regarding the child's digital environment. This is a personal interview. Source available to SHIELD.
Source: SHIELD - APS, Italy
Date source link verified: 14/10/2026
Technology in Education
ItalyRegulatory Action
School Electronic Register Error Exposes Minor Student’s Individualized Education Plan to Class Parents
A support teacher at a school in Italy mistakenly configured the visibility settings on the school's electronic register while uploading an Individualized Education Plan (PEI). This error made a minor student's sensitive educational and disability records visible to all parents of the classroom for approximately 22 minutes. During this window, another parent saw the notification, took a screenshot, and shared it in a class messaging group. The student's parents subsequently retained an attorney and filed a formal complaint with the Italian Data Protection Authority, which issued an official reprimand to the school.
Source: Garante per la protezione dei dati personali
School email to about 37 families with visible addresses reveals children missing vaccination paperwork; school asks email software vendor for a warning, Lombardy, Italy
Parents complained through a lawyer that the school sent a vaccination-compliance reminder to about 37 families with all addresses visible, revealing which children were not in order. The school notified a data breach, retrained staff, and asked the software house that supplies its email program to add a warning whenever several recipients are entered. The Italian Data Protection Authority (Garante) found an unlawful communication of health data and fined the school EUR 1,000. The family first noticed. Responses acted on the school and, through its request, the vendor's tool. Whether the vendor added the warning is not stated in source.
Source: Garante per la protezione dei dati personali
School Employee’s Sensitive Medical Data Exposed via Document Management Software
An employee of a school in Italy had their highly sensitive medical information and labor dispute details exposed to 14 coworkers. The incident occurred when an administrative worker mistakenly uploaded the employee's court documents onto the ordinary registry of the school's document management software instead of the restricted, reserved protocol. Consequently, the employee filed a formal warning demanding the removal of the files and lodged a complaint with the Italian Data Protection Authority, which resulted in a regulatory fine of €1,000 for the school.
Source: Garante per la protezione dei dati personali
Secondary school student required to use WhatsApp and gained unavoidable access to AI chatbot
A parent reported that a secondary school teacher required class communication through WhatsApp. After Meta AI was integrated into the platform, the child (a secondary school student) gained access to an AI chatbot that could not be deactivated or restricted. The parent reported being unable to prevent their child's access to the AI tool while maintaining necessary participation in school-mandated communications. This is a personal interview. Source available to SHIELD.
Source: SHIELD - APS, Italy
Date source link verified: 14/10/2026
Technology in Education
ItalyNews article
Support teacher allegedly shows pornographic videos to middle school pupils under pretext of tutoring, then continues via social media group
A female support teacher at a middle school was arrested in January 2025, accused of taking pupils into a school room under the pretext of tutoring, showing them pornographic videos and sexually abusing one of them, starting in October 2023. When the room was closed, she allegedly continued the abuse through a private social media group, sending sexually explicit messages and threatening the pupils with academic and personal retaliation. Six child victims were interviewed by authorities; charges include sexual violence and corruption of minors.
Teacher Absences and Schedules Unlawfully Exposed on Public Website and Electronic Register
An Italian public school published the service hours and recess surveillance shifts of teachers, including an adult teacher, on its public website. Additionally, instead of using a restricted administrative module, the school utilized the public bulletin board function of an electronic register platform to manage teacher absences and substitutions, thereby exposing the teacher's absences to unauthorized colleagues, students, and parents. The Italian Data Protection Authority ruled this was an unlawful communication of personal data and fined the school.
Source: Garante per la protezione dei dati personali
Teacher convicted for lowering two grades already recorded on the electronic register, Lombardy, Italy
A female upper secondary school student took a screenshot of her grade on the register on the day it was given, then noticed the teacher had later lowered it and captured that too. In February 2018, a court in Lombardy, Italy, sentenced the teacher to 13 months' imprisonment for material falsification by a public official (art. 476 of the criminal code) over changes to two of the student's grades. The student first noticed. The response acted on the person responsible. Whether the register or school procedures changed is not stated in source.
Teacher’s intimate image sent to WhatsApp class chat and seen by students including minors
A teacher reportedly unintentionally sent an intimate image into a class WhatsApp chat. Students viewed and downloaded it before deletion and parents contacted law enforcement.
Each record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
Using the directory
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
How to cite
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
Corrections and removals
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Report an incident
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
