Cyber Incident Victim: Comune di Alcamo
Date:
Mar 2025
Location:
Italy
Summary
A cyber incident involved distributed denial-of-service (DDoS) attacks targeting multiple Italian municipal and regional websites, including those of Verona, Rome, Milan, Catania, and the regions of Lazio, Piedmont, Apulia, and Aosta Valley. The attacks aimed to disrupt services by overwhelming sites with fraudulent traffic, causing temporary inaccessibility for Verona's municipal portal. While no severe operational impacts were reported, national cybersecurity agencies actively monitored and responded to mitigate the threats. This marked the second such attack on Verona's systems within a short timeframe, indicating a broader campaign against local government and transportation sector infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 1, 2025, a coordinated wave of distributed denial-of-service (DDoS) attacks targeted Italian municipal and regional government websites, marking the second such incident affecting Verona’s systems within a week. The attacks impacted the official websites of the municipalities of Verona, Rome, Milan, and Catania, alongside regional government portals for Lazio, Piedmont, Puglia, and Valle d’Aosta. Attackers flooded these sites with fraudulent traffic requests in an attempt to disrupt normal operations by overwhelming server capacity. The transport sector was also identified as a secondary target, though specific entities were not detailed in initial reports. Verona’s municipal site experienced temporary inaccessibility during the incident, though no other locations reported prolonged outages. Cybersecurity analysts confirmed the attacks followed a similar DDoS methodology to those observed in the prior Verona incident, which had occurred fewer than seven days earlier.
National Cybersecurity Agency personnel activated monitoring protocols to track attack patterns and mitigate disruptions. No data breaches, system compromises, or permanent damage to infrastructure were confirmed across the affected entities. Service restoration efforts prioritized maintaining public access to critical municipal portals, with Verona’s site returning to functionality after brief interruptions. The agency refrained from attributing responsibility for the attacks and did not disclose technical specifics of the mitigation measures employed. Impact assessments indicated minimal operational consequences beyond temporary accessibility issues, with no evidence of data exfiltration or secondary attack vectors. Monitoring continued post-incident to detect potential follow-on activity targeting the same entities.