Provincia di Perugia

Summary

The Provincia di Perugia experienced a cyberattack targeting internal server data through encryption, aimed at causing operational disruption. The organization's technical team and contracted cybersecurity experts promptly intervened, successfully blocking the attack due to recently enhanced perimeter defenses, including next-generation firewalls and participation in a protective cybersecurity framework. Authorities including the Postale Police were engaged to investigate the incident. While assessments to determine the full impact remain ongoing, all offices maintained regular operations throughout the response.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 1, 2023, the Provincia di Perugia experienced a cyberattack targeting its internal servers with data encryption, intending to disrupt operations. The attack was promptly detected and addressed by the organization’s technical team alongside cybersecurity experts from their contracted security firm. No systems were reported as compromised beyond the encryption attempt, and the entity’s offices maintained regular operations throughout the incident. Immediate containment efforts focused on isolating affected systems and analyzing the encryption methodology. The attack’s primary objective appeared to be service disruption rather than data exfiltration, as no evidence of unauthorized data access or theft was disclosed in the initial assessment.

The province attributed its successful defense to recent cybersecurity upgrades, including a next-generation perimeter firewall implemented in July 2023 and participation in the Consip "Cybersecurity 2" framework agreement adopted in September 2023. This framework involved significant investment in protective measures described as a "shield" for safeguarding data. Following containment, the Provincia di Perugia notified the Postale Police (Polizia Postale), which initiated an investigation to identify the threat actors and attack vectors. Forensic examinations remained ongoing to fully assess the attack’s impact, though preliminary analysis confirmed no operational downtime or public service interruptions. All administrative functions continued without closure or reduced accessibility during and after the incident.

Sources

Sources available to members: 1 source.