Cyber Incident Victim: Europea Microfusioni Aerospaziali Spa
Date:
Nov 2022
Location:
Italy
Summary
A European aerospace manufacturer experienced a disruptive cyberattack that forced a complete shutdown of IT systems and halted all operations. The incident prompted the company to implement temporary layoffs under an "unexpected and sudden event" framework while technical teams, supported by external cybersecurity specialists and Rolls-Royce's coordination, worked to restore systems. Partial operational resumptions occurred in select production departments during the following week under strict safety and operational standards, with plans for gradual full recovery across production, management, and administrative functions. The extended disruption significantly impacted workforce operations, requiring ongoing adjustments to restore normal activity timelines.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 6 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the night of November 17, 2022, Europea Microfusioni Aerospaziali Spa (EMA S.p.A.) experienced a cyberattack that forced the immediate shutdown of its information systems, halting all operational activities. The company first addressed the disruption during an initial meeting with union representatives (RSU) at 10:00 AM on November 17, though the cause remained undetermined at that time. By November 21, following continuous technical investigations, EMA formally confirmed the cyberattack’s role in the outage during a follow-up meeting with the RSU delegation, which included human resources leadership, operational directors, and union representatives. Technical teams from EMA, supported by an external cybersecurity firm and coordinated with Rolls-Royce’s technical division, had worked without interruption since November 17 to assess the breach and restore systems. As a direct consequence of the attack, EMA implemented the CIGO (Cassa Integrazione Guadagni Ordinaria) wage support mechanism for all employees from November 17–20, citing an "unforeseen and sudden event" under Italian labor regulations.
The company extended the CIGO measure through November 25, 2022, while cautiously resuming partial operations in select production departments based on safety, technical feasibility, and Rolls-Royce operational standards. EMA prioritized redeploying employees with specialized technical, organizational, or safety-related skills to support limited activities during the recovery phase. This phased reopening had begun during the week of November 14–18 and continued into the week of November 21–25 under a structured schedule designed to ensure compliance with safety protocols. EMA emphasized its objective of achieving a full restoration of production, administrative, and managerial functions within a "reasonable timeframe," though no specific target date was disclosed. All communications regarding the incident and workforce measures were reviewed and authorized by EMA’s People (HR) division before being shared with the RSU, formalizing the company’s response to the operational crisis.