Marposs

Summary

An Italian precision measurement equipment manufacturer headquartered near Bologna fell victim to a Cryptolocker ransomware attack that encrypted data on several company servers during a weekend incident. The attack disrupted business operations unevenly, with logistics functions suffering more significant impact than production activities. In response, the company immediately reported the incident to the Postal Police, who opened an investigation to identify the perpetrators, and engaged a team of cybersecurity experts to restore affected systems. To protect both employees and operations while recovery efforts were underway, the organization requested activation of ordinary redundancy fund (cassa integrazione) measures on a flexible, partial basis for the most affected departments, with the measure set to gradually reduce as activities were restored.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In the night between Sunday and Monday in late January 2025, Marposs, a large company headquartered in the Bologna area specializing in the supply of precision measurement equipment for industries, fell victim to a cyberattack. The attack was described by the company as a "Cryptolocker" type cyberattack directed at some servers that were part of its information system. Cryptolocker-style attacks are a form of ransomware operation in which criminals use malicious software to encrypt the data present on the targeted systems, thereby rendering the information inaccessible to the victim organization. Once the data is encrypted, the attackers typically demand the payment of a ransom from the victim in exchange for the decryption key or for the restoration of access to the locked files. According to the information made available, this strategy produced a diversified impact on the company's activities, with more serious consequences recorded in the logistics area of operations and comparatively less severe effects on the production side of the business. The company itself communicated the incident publicly and began coordinating its response immediately after the intrusion was identified.

In response to the attack, Marposs took several concrete steps to address both the criminal investigation and the operational recovery. The company promptly filed a report with the Polizia Postale, the Italian postal and communications police unit responsible for investigating cybercrime, which subsequently opened an investigation aimed at identifying those responsible for the intrusion. In parallel with the law enforcement notification, Marposs engaged a team of cybersecurity experts to work on restoring the affected systems and bringing the company's operations back to normal functioning. As an interim measure to contain the consequences of the attack and to protect both its personnel and the organization as a whole while data recovery efforts were underway, the company requested the activation of the Cassa Integrazione Ordinaria, Italy's ordinary wage supplementation scheme that allows employers to temporarily suspend or reduce work activities while maintaining income support for employees. The company specified that this instrument, which is designed for emergency situations of this nature, would be applied in a partial and flexible manner to the departments most affected by the incident. The company further indicated that the scope of the wage supplementation scheme would be progressively reduced as activities were gradually restored to full operation.

The decision to activate the wage supplementation scheme was met with immediate support from both employees and the trade union organizations involved. According to the company's own communications, the workforce and union representatives committed themselves from the outset to addressing the emergency and to ensuring a rapid return to full operational capacity at the affected facility. The measure of the Cassa Integrazione Ordinaria was set to remain in effect until February 7, covering the period during which the cybersecurity specialists worked to decrypt the data that had been locked by the attack and to restart the company's systems. The company framed the wage supplementation request as a protective measure for its people and for the organization itself during a period in which normal business activities could not be fully carried out. As of the reporting of the incident, the timeline for full decryption of the affected data and the complete resumption of all company activities remained dependent on the work of the cybersecurity specialists engaged for the recovery effort, while the Polizia Postale continued its investigation to identify the perpetrators of the attack.

Sources

Sources available to members: 1 source.