Unione dei Comuni Valdisieve e Valdarno

Summary

A cyberattack disrupted the IT systems of a Tuscan municipal union, causing widespread service outages and operational failures. Precautionary measures included shutting down networks to contain the incident, suspected to involve ransomware-like behavior. Most public-facing and online services became unavailable during recovery efforts, which relied on backup systems and were expected to take several days. Authorities acknowledged potential personal data breaches, initiated remediation protocols, and formally reported the incident to relevant oversight bodies while apologizing for service interruptions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On the morning of July 27, 2022, the Unione dei Comuni Valdisieve e Valdarno—a municipal union comprising the Tuscan towns of Londa, Pelago, Pontassieve, Reggello, Rufina, and San Godenzo—experienced widespread IT system failures affecting approximately 64,000 residents. Initial disruptions included network outages and service interruptions across administrative systems, prompting an immediate investigation. By midday, authorities confirmed the incident stemmed from a cyberattack, with early technical assessments suggesting ransomware-like behavior. As a precautionary measure, the municipal union disconnected all affected systems from the network to contain the attack and prevent further propagation. This action rendered most public-facing and online services inoperable, including essential citizen services managed through the union’s centralized infrastructure. The shutdown impacted all six member municipalities spanning the Valdisieve and Valdarno territories, covering 546 square kilometers of mixed urban and rural communities. Technical teams prioritized isolating compromised systems while evaluating the scope of the intrusion and potential data exposure.

Response protocols included activating contingency measures to address possible personal data breaches, though specific compromised data types remained unspecified in public communications. Authorities issued formal apologies for service disruptions via public statements, acknowledging extended recovery timelines while emphasizing reliance on backup systems for data restoration. The municipalities of Reggello and the Unione Valdarno Valdisieve jointly notified competent authorities, initiating criminal investigations and regulatory compliance procedures. Full service restoration was projected to require multiple days due to the necessity of secure system rebuilding and data recovery processes. Parallels were drawn to a contemporaneous ransomware incident affecting Palermo’s municipal operations, underscoring recurring vulnerabilities in Italian local government IT infrastructures. Throughout the response, operational continuity challenges persisted, with no confirmed timeline for full normalization of services by the conclusion of July 28.

Sources

Sources available to members: 3 sources.