Giorgio Armani S.p.A.

Summary

Giorgio Armani SpA experienced a significant ransomware attack disrupting IT systems, particularly at its Milan headquarters, which partially halted operational capabilities across certain manufacturing facilities. The incident, attributed to a malicious email attachment exploiting macros to deploy malware, prompted an intensive response from internal IT specialists to contain the threat and restore functionality, with some sites resuming operations swiftly. While the breach caused notable disruptions, parliamentary security committee COPASIR indicated the damage was less severe than initially feared, and no ransom demands or claims of responsibility emerged following the attack.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On April 16, 2022, Giorgio Armani SpA experienced a significant ransomware attack that disrupted operations across multiple facilities. The intrusion occurred concurrently with a similar attack against Trenitalia, though no direct connection between the incidents was established in initial reports. Attackers compromised the fashion house’s IT infrastructure through a malicious email attachment containing Office macros, which executed ransomware payloads after user interaction. This led to partial system outages, particularly at the company’s Milan headquarters, where critical IT systems were rendered inoperable. The malware propagated through networked systems, encrypting files using robust cryptographic standards—likely AES-128/256 or RSA—which complicated decryption efforts without the attackers’ keys. Production facilities faced operational paralysis, though the Trento (Mattarello) and Trissino (Antinea) plants resumed activity relatively quickly compared to other affected sites.

Armani’s cybersecurity team immediately engaged in containment and recovery efforts, working to isolate infected systems and prevent lateral movement across the network. No ransomware group claimed responsibility for the attack, and no public ransom demands were issued during the incident’s initial phase. The Italian Parliamentary Committee for Security (COPASIR) publicly acknowledged the breach, noting damage appeared less severe than initially feared. While backups and specialized IT personnel facilitated restoration at some locations, the company did not disclose whether encrypted data was fully recovered or if backups were compromised during the attack. Operational disruptions remained localized to specific manufacturing and administrative units, with no evidence of customer data exfiltration or secondary attacks reported. The incident underscored vulnerabilities in macro-enabled document workflows, though Armani’s response timeline and partial system recovery suggested existing resilience measures mitigated broader operational collapse.

Sources

Sources available to members: 1 source.