Cyber Incident Victim: Trentino-Alto Adige
Date:
Jun 2025
Location:
Italy
Summary
The Trentino-Alto Adige region suffered a cyberattack that disrupted telephone systems at the State Traffic Information Center, State Emergency Call Center, Fire Brigade headquarters and State Radio Service. Although emergency call lines remained open for the public, traffic reporting and infomobility services were affected, a ransom note was left in the compromised facilities and not paid, and staff have been working manually while restoration efforts continue.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the evening of June 23, 2025, technical problems were detected in the telephone systems or parts thereof of the State Traffic Information Center, the State Emergency Call Center, the Professional Fire Brigade headquarters, and the State Radio Service. The disruptions primarily affected traffic reporting data and impacted infomobility services. Despite the impairments, emergency call centers remained accessible by phone and there were no restrictions on emergency calls for the public. The Civil Protection Agency immediately deployed its communications system in response to the detected issues. The responsible authorities and the public prosecutor's office were informed without delay.
By the morning of June 24, 2025, officials identified the cause of the outage as a cyberattack, a statement confirmed by Governor and State Councilor for Civil Protection Arno Kompatscher during a press conference following the state government meeting. A ransom demand was placed in the contaminated facilities, but it was not met. Immediate activation of appropriate procedures prevented major damage, and the problem was identified and completely contained. Additional staff were assigned to the State Emergency Call Center to handle processes manually while work continued around the clock to restore the affected systems. Traffic reporting and information mobility services at the State Traffic Information Center were reported to be functioning again by the afternoon update.
Throughout the incident, all affected areas maintained communication and were engaged in the process of fully restoring the systems. Surveys and investigations into the cyberattack remained ongoing, with all official communications being issued through the designated channel. The Civil Protection Agency and the South Tyrolean Health Service committed to providing further information as the situation evolved. The public was asked for its understanding regarding the technical disruption, and authorities emphasized that emergency services remained fully operational for citizens.