Cyber Incident Victim: Network Contacts SpA
Date:
Apr 2022
Location:
Italy
Summary
A cyberattack targeted Network Contacts SpA, a supplier to Enel, resulting in the theft of sensitive personal data including names, tax identification numbers, postal addresses, phone numbers, and email addresses. The compromised company implemented immediate measures to contain the breach, secured its systems to prevent recurrence, and assured protection of affected data. Authorities were notified, and impacted individuals were provided a dedicated contact number for further information. This incident underscores supply chain vulnerabilities as third-party providers increasingly become attack vectors for data exfiltration, highlighting risks beyond direct corporate infrastructure compromises.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 27, 2022, Network Contacts SpA, a supplier to Italian energy company Enel, suffered a cybersecurity incident involving unauthorized data exfiltration. The compromised information included names, surnames, tax identification numbers (codice fiscale), VAT numbers, postal addresses, telephone numbers, and email addresses of affected individuals. Enel subsequently notified impacted customers through direct communications, confirming the breach at its third-party provider. Network Contacts stated it immediately implemented measures to block the attack and secure its IT systems against recurrence, though specific technical details of the attack vector or intrusion methodology were not disclosed in the notification. The company asserted it had safeguarded the personal data under its control and notified relevant authorities, though no regulatory bodies were named in the source material. Affected individuals were directed to a dedicated toll-free number for additional information about the breach.
The incident highlighted supply chain security vulnerabilities, with attackers targeting a third-party provider rather than Enel's direct infrastructure. Network Contacts' role as a data processor for Enel created collateral exposure of customer information despite originating from a separate organizational entity. No evidence suggested operational disruption to Enel's services, with impacts confined to data exposure through the supplier. The supplier's public response emphasized contractual compliance and procedural safeguards rather than technical specifics of remediation efforts. Enel's disclosure framework shifted accountability communications through its customer notifications while maintaining separation from Network Contacts' operational response. The breach exemplified supply chain attack risks through third-party system compromises, though attribution, motive, and exact data exfiltration methods remained unspecified in available reporting.