Westpole

Summary

Westpole experienced a cybersecurity incident involving suspicious activity in its Italian data center, prompting immediate emergency response measures to contain the threat and minimize service disruptions for clients. The company successfully contained the incident and is actively restoring affected IT environments, with over 60% of clients resuming normal operations; ongoing efforts focus on full system normalization while monitoring through its SOC and Incident Response Teams. No evidence of customer data exfiltration was identified during the investigation.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 8, 2023, Westpole SPA detected suspicious activity within its Italian data center infrastructure, triggering immediate activation of predefined emergency protocols. The incident caused operational disruptions impacting both Westpole's internal systems and the IT environments of multiple clients, resulting in widespread service interruptions. Westpole confirmed no evidence of customer data exfiltration or leakage within client-facing systems at the time of reporting. Technical teams and external partners initiated 24/7 mitigation efforts focused on containment, system security reinforcement, and minimizing client impact. Rapid containment was achieved, though full operational restoration remained incomplete during the initial response phase.

Westpole prioritized reconstructing affected client IT environments through sustained round-the-clock recovery operations, successfully restoring normal operations for over 60% of clients post-containment. The Security Operations Center (SOC) maintained continuous environmental monitoring while coordinating with Incident Response Teams to track residual impacts affecting remaining clients. Transparent communication protocols were implemented to provide regular updates to all impacted customers regarding restoration progress. Recovery efforts concentrated exclusively on system rebuilding and security hardening without public disclosure of specific technical vulnerabilities exploited. Service normalization continued as the primary operational focus, with Westpole committing to further updates contingent upon material changes in incident status or recovery timelines.

Sources

Sources available to members: 1 source.