A forgotten service account can be enough to derail an entire media outlet's communications. That is what happened to Telecittà, a local television channel in Italy's Veneto region whose publisher, Andrea Zanella, also runs the stations Radio Sunbeat and Radio 906. The trade site FM-world reported the incident on 8 November 2026. It is a case that matters directly to web radio stations, whose audiences rely heavily on social media.
Two days of hateful content and a fake live stream
Between Thursday 5 and Friday 6 November, hackers managed to get into the tools used to manage the channel's social profiles. They posted hateful and violent content there, including racist insults and images of armed terrorists, with no connection to the outlet's editorial line. They also started a live broadcast on Facebook, temporarily interrupting Telecittà's usual online programming.
The alarm was not raised by an internal alert but by Meta: the platform sent notifications that several posts had been removed for breaking its rules. According to the publisher, those two notifications made it clear that something was wrong and allowed the team to react.
A service account as the way in
Checks carried out on the servers revealed unauthorised access through a service account, in other words a technical login used by tools rather than by a person. The team disconnected it, reported the incident to Meta and was able to shut down the live stream started by the intruders.
Beyond the intrusion itself, Andrea Zanella was mostly worried about years of accumulated work. The group has invested heavily in digitising its radio stations, in Italy and abroad, and social media is considered crucial for a channel so rooted in its local area. His fear was that the page could be suspended because of the content the hackers had posted. The publisher also acknowledges that, despite insurance and security systems, the attackers seem to have acted with ease, and believes that larger media groups are just as exposed.
What it means for web radio stations
A web radio station often depends on a handful of accounts: the Facebook page, the Instagram account, the YouTube channel, the streaming server and the website's admin panel. Many are connected to third-party tools for scheduling posts, multistreaming live video or automation. Every such connection is a potential service account, and they are rarely monitored. A few good practices reduce the risk:
- take stock of the apps and tools connected to your social pages, and revoke those you no longer use;
- turn on two-factor authentication for every admin account, including those of volunteers and presenters;
- assign named roles instead of sharing a single login, so you know who has access to what;
- keep an eye on platform notifications: as in this case, they are sometimes the first sign of an intrusion;
- prepare an emergency procedure: who cuts off access, who contacts the platform, how listeners are informed.
Protecting listeners' trust as well
For a listener, seeing hateful messages on the page of a favourite station can be enough to break the bond. And for the publisher, an account suspension can cut off a major source of listening overnight. The Telecittà case is a reminder that digital security is now part of a broadcaster's job, just like the quality of the audio stream.
Source : FM-world