Cyber Incident Victim: Comune di Brescia
Date:
Mar 2021
Location:
Italy
Summary
A cyberattack targeted the Municipality of Brescia's IT systems, encrypting personal data and documents held by the administration. While no evidence of data theft or unauthorized dissemination was identified, the encrypted information could not be fully restored, requiring reorganization and reacquisition efforts by municipal offices. The full scope of impacted data categories and volumes remained undetermined at the time of reporting. Services and central and peripheral IT systems were undergoing restoration to resume normal operations. Affected individuals were directed to contact relevant municipal departments via published phone contacts for specific inquiries regarding personal data or service disruptions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 31, 2021, the Municipality of Brescia experienced an external cyberattack targeting its ITC systems, resulting in the encryption of municipal documents and personal data under its control. The attack disrupted regular administrative services and compromised the functionality of both central and peripheral IT infrastructure. While the municipality confirmed the encryption of data, it found no evidence of data theft or unauthorized dissemination of personal information during its initial assessment. The incident necessitated extensive recovery efforts, including the reorganization and reacquisition of encrypted data that could not be restored through technical means. Municipal offices prioritized restoring full operational capacity to resume public services while adhering to confidentiality regulations governing personal data handling.
The municipality acknowledged it could not definitively determine the exact categories or volume of compromised data and documents at the time of its July 2022 public statement. Recovery operations focused on rebuilding systems and re-collecting affected data directly from citizens or source documents where necessary. Citizens were directed to contact specific municipal departments via published phone numbers for inquiries regarding personal data processing, deadlines, or urgent communication needs. No ransomware actors or specific attack vectors were disclosed in the public advisory. Service restoration timelines remained unspecified, though the municipality emphasized ongoing efforts to normalize all IT systems and maintain transparency through institutional channels.