Regione del Veneto

Summary

A cyberattack targeted an Italian municipality, disrupting administrative services including the issuance of identity cards and documents. While email communications and the official website remained functional, digital work platforms were compromised by malware, causing significant operational paralysis. The mayor reported no ransom payments or engagement with attacker demands, though evidence suggested financial extortion attempts. IT consultants immediately initiated recovery efforts, but full restoration of secure systems required additional days due to persistent platform contamination. The incident highlighted evolving threats against public institutions, with attackers circumventing existing security measures. Local authorities filed a formal report with cybercrime police to investigate the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On June 17, 2022, the municipal administration of Fossalta di Piave in Italy’s Veneto region suffered a cyberattack that disrupted critical services. The attack compromised digital work platforms, forcing the municipality to suspend operations related to issuing identity cards and other administrative documents. Email services and the official municipal website remained operational, allowing limited public communication. Mayor Manrico Finotto filed a formal complaint with the postal police to initiate an investigation. IT consultants were immediately engaged to restore systems, though significant contamination from the malicious software prolonged recovery efforts. Administrative operations experienced severe disruption, with no indication that ransom demands were acknowledged or fulfilled by municipal authorities.

The attackers delivered a virus through an email that municipal staff deliberately avoided opening, though officials anticipated further communication attempts containing financial demands. Containment measures involved isolating infected systems, resulting in a complete shutdown of compromised digital platforms to prevent further spread. Initial recovery projections proved overly optimistic, as technical teams required additional days beyond the expected June 21 resolution date to fully restore secure administrative functions. Mayor Finotto characterized the incident as part of an escalating trend of sophisticated cyberattacks targeting public institutions, noting attackers’ increasing ability to circumvent security measures. The prolonged outage underscored substantial operational vulnerabilities, with recovery efforts prioritizing secure reactivation of document processing systems essential for public services.

Sources

Sources available to members: 1 source.