Cyber Incident Victim: Alto Calore Servizi S.p.A.

On or around April 1, 2023, Alto Calore Servizi S.p.A., a water utility company, experienced a significant operational incident directly impacting its customer base. The incident was characterized by a widespread failure of water meters due to freezing conditions. The meters most susceptible to damage were those identified as being located externally in meter boxes or wall niches, as well as those situated in uninsulated rooms or in properties that were rarely occupied. The primary cause of the failure was a prolonged period of sub-zero external temperatures, which caused the water inside the meters and associated piping to freeze, expand, and subsequently rupture the equipment.

The company's immediate response to the incident was the activation of its customer communication channels via its official website. A prominent notice was published that detailed the nature of the problem and provided explicit, step-by-step guidance for customers to follow. This guidance was segmented into preventative measures for ongoing freezing conditions and corrective actions for meters that had already failed. For prevention, customers were advised to allow a small, continuous stream of water to flow from a tap to prevent stagnation and freezing, a measure explicitly sanctioned by the company's own regulations. They were also instructed to properly insulate at-risk meters and piping using specific materials like expanded polystyrene or polyurethane panels with a minimum thickness of three to four centimeters. The company cautioned against the use of inadequate materials such as glass wool or rags, which absorb water and can increase the risk of damage by freezing themselves, in addition to becoming a potential nest for insects and dirt.

For meters that were already frozen but not yet broken, the advised response was to wrap the meter in an old blanket or newspapers and wait for it to thaw naturally. In cases where meters were located in vacant buildings, the recommended action was to close the shut-off valve upstream of the meter and proceed to drain the downstream system entirely. This was part of a broader effort to contain the damage and prevent further property loss. The incident required a clear delineation of responsibility between the company and its customers. Alto Calore Servizi S.p.A. stated that in the event of damage due to customer negligence, including a failure to take appropriate anti-freeze measures, the cost of the new meter and the labor required for its replacement would be charged directly to the customer. This charge was to be calculated based on the price list in effect at the time of the incident.

The company established specific response protocols for customers who discovered a meter rupture. Customers were instructed to promptly call a designated emergency number that was linked to their specific service district. This directive was intended to streamline the dispatch of repair crews and ensure a coordinated organizational response to the widespread outages. For damage that occurred on the customer's internal plumbing system, beyond the meter, the guidance differed; customers were told to immediately close the main water shut-off valve and contact a trusted plumber for the necessary inspections and repairs, indicating the limit of the utility's operational responsibility.

The scope of the incident also extended to communal condominium systems, requiring a separate set of response actions. The company advised building managers to insulate sections of piping exposed to the air, particularly those traversing entrance halls or other open, unheated rooms. Protecting common area meters from frost was emphasized, with special attention to be paid to those located in such vulnerable areas. For individual apartments within these buildings, the guidance included closing the valves upstream of meters in cases of prolonged absence and, if possible, draining the system downstream. Furthermore, it was recommended to close the shut-off valves upstream of meters and drain the internal systems of vacant or unoccupied apartments. During periods of particularly intense cold, a suggested measure was to temporarily use common area water points to drain the building's vertical riser columns, a technique aimed at preventing large-scale freezes within the core infrastructure of the condominium.

The impacts of this incident were operational and financial. The operational impact involved a surge in service calls and emergency repairs, straining the company's response resources. The financial impact was twofold: the company bore the cost of repairing or replacing meters damaged by frost where negligence was not a factor, while customers deemed responsible for damage due to a lack of preventative action were liable for all associated costs. The incident did not involve a cyber component such as a data breach or system intrusion; it was a physical infrastructure failure driven by environmental conditions. The response was focused entirely on physical remediation, customer guidance, and the enforcement of contractual and regulatory policies to manage the consequences of the freezing event.