Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Lazio Region ransomware attack on the regional health system
In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services.
In short
In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services. Bookings, payments, report collection and vaccination registration stopped. The Garante Privacy, Italy's data protection authority, later fined the operator LAZIOcrea, the Region and one health authority for weak security. The way in was a remote work laptop and an unpatched server.
What happened
In the night between 31 July and 1 August 2021 an attack hit the information systems of the Lazio Region. The systems are run by LAZIOcrea, the company that manages the regional information systems, for the Region, the regional council and several health service bodies. The Garante Privacy says a ransomware program blocked access to many health services: bookings, payments, report collection and the registration of Covid-19 vaccinations.
About 180 virtual servers became inaccessible. LAZIOcrea also chose to switch off all systems, because it could not tell which were compromised and could not stop the malware from spreading. Health bodies could not use some regional systems for a period that ran from a few hours (48) to several months.
LAZIOcrea told the Garante that emergency services (112, 118, transfusion centers, emergency rooms and civil protection) were never interrupted, and that the vaccine booking service came back within four days. In April 2024 the Garante fined LAZIOcrea, the Region and ASL Roma 3 for security and notification failures.
Timeline
-
25 March 2021
Backdoors are installed on the personal computer an employee used for remote work; antivirus cannot detect them (LAZIOcrea statement to the Garante).
-
31 July 2021, 16:49
The attackers start preparatory operations.
-
31 July 2021, 21:12
Microsoft security platforms raise a high-severity incident made of 2,189 alerts.
-
1 August 2021, 00:00
The encryption routine starts.
-
1 August 2021, early morning
Some virtual machines are found unusable; LAZIOcrea takes all systems offline.
-
1 August 2021
LAZIOcrea says it reported the attack to CSIRT and CNAIPIC by email.
-
Early August 2021
A security operations center run by Leonardo S.p.A. goes live.
-
Within four days of the attack
The vaccine booking service is restored (LAZIOcrea statement).
-
13 August 2021
Date up to which vaccination slots were already booked when the attack happened.
-
16 August 2021
Third-party vendors can start reinstalling their systems in the data center.
-
End of October 2021
The most critical systems, such as Covid-19 vaccination, are fully restored.
-
21 March 2024
The Garante adopts its decisions on LAZIOcrea, the Region and ASL Roma 3.
-
10 April 2024
The Garante announces fines of EUR 271,000, 120,000 and 10,000.
How the attack worked
The best account is the one LAZIOcrea gave the Garante and the Garante recorded in its decision. It is the company’s own statement, so it is not an independent finding. The Garante’s newsletter says the ransomware came in through a laptop used by a Region employee. LAZIOcrea says the credentials were stolen from the employee’s personal computer used for remote work. The two accounts agree that an employee’s device was the way in.
Step 1: a remote worker’s device
LAZIOcrea says backdoors were installed on the personal computer on 25 March 2021, months before the attack. Antivirus software could not detect them, and they were used to steal the employee’s login. Remote access to the company network ran over a VPN, and at the time there was no multi-factor authentication for VPN access.
Step 2: scanning and an unpatched server
With the stolen credentials the attackers connected remotely and scanned the network and its servers. They found a server whose base software no longer received security updates. LAZIOcrea says it was kept for an old web application and was running Windows Server 2008 R2 Standard. Using known vulnerabilities on that server, the attackers got credentials with administrator rights.
Step 3: encryption
The attackers prepared the attack from 16:49 on 31 July. Microsoft security platforms raised a high-severity incident of 2,189 alerts at 21:12. The encryption routine started at 00:00 on 1 August. LAZIOcrea says the malware belongs to the family known as RansomEXX, also called Defray777.
The Garante found that the networks of the servers were not segregated. LAZIOcrea therefore could not tell which systems were affected or stop the spread, and it switched everything off. Staff reviewed security alerts round the clock, but a security operations center from Leonardo S.p.A. only went live in the first days of August 2021.
- Remote worker deviceBackdoors installed on 25 March 2021 on a personal computer used for remote work
- Stolen loginThe employee’s credentials are taken; VPN access has no multi-factor stepTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- Remote accessThe attackers connect to the company network and scan serversTechnique T1133 (MITRE ATT&CK, opens in a new tab)
- Unpatched serverKnown vulnerabilities on a server without updates give administrator credentialsTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- RansomwareEncryption starts at 00:00 on 1 August; about 180 virtual servers become inaccessibleTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- All systems offLAZIOcrea switches off all systems because networks are not segregated
ATT&CK techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
No public attribution to a named actor. LAZIOcrea described the attackers as unknown cybercriminals and told the Garante the malware belongs to the family known as RansomEXX, alias Defray777. This is the company's statement as recorded in the Garante decision, not a finding by the Garante or by a court.
Impact
Services: the Garante says the breach blocked access to many health services, including bookings, payments, report collection and vaccination registration. About 180 virtual servers were inaccessible. Health bodies could not use some regional systems for a period from a few hours (48) to several months, and the Garante records that the most critical systems, such as Covid-19 vaccination, were fully restored at the end of October 2021.
Emergency care: LAZIOcrea says emergency services 112 and 118, transfusion centers, emergency rooms and civil protection were never interrupted.
Vaccination: LAZIOcrea says the booking service was restored in four days, and that existing slots were already booked up to 13 August.
Data: LAZIOcrea's analysis found no flow of data to the outside during the attack, and it says no data was published on the dark web even near the deadline of the hackers' ultimatum. This is the company's statement.
Penalties: the Garante fined LAZIOcrea EUR 271,000, the Lazio Region EUR 120,000 and ASL Roma 3 EUR 10,000.
Government and regulator response
- 1 August 2021: LAZIOcrea says it reported the attack to CSIRT and CNAIPIC by email, and took all systems offline to protect the integrity and confidentiality of data.
- Early August 2021: a security operations center run by Leonardo S.p.A. went live. The vaccine booking service was restored within four days, according to LAZIOcrea.
- 16 August 2021: third-party vendors could start reinstalling their systems in the data center.
- End of October 2021: the most critical systems were fully restored.
- 21 March 2024 (announced 10 April 2024): the Garante Privacy, which acted on its own initiative after press reports, fined LAZIOcrea EUR 271,000, the Region EUR 120,000 and ASL Roma 3 EUR 10,000. It found serious breaches mainly due to outdated systems and missing security measures. It said the Region should have supervised LAZIOcrea more effectively, and that ASL Roma 3, unlike other health bodies, did not notify the breach.
Lessons
-
Remote work devices are an entry point
The Garante newsletter says the ransomware came in through an employee's laptop. LAZIOcrea says the login was stolen from a personal computer. Control and monitor devices used for remote access.
-
Add a second factor to VPN
At the time there was no multi-factor authentication for VPN access, so a stolen password was enough.
-
Retire or isolate unsupported servers
A server without security updates, kept for an old application, gave the attackers administrator credentials.
-
Segment networks
Because the networks were not segregated, LAZIOcrea could not tell which systems were compromised and switched everything off. Segmentation limits both spread and downtime.
-
Detection needs people who act on it
Microsoft platforms raised a 2,189-alert incident at 21:12, hours before encryption started at midnight. A security operations center only went live in early August.
-
Suppliers and customers share the duty
The Garante fined both the operator and the Region for weak oversight, and fined a health authority for not notifying the breach.
What to check in your own organization
-
VPN login
Check that every remote access path needs more than a password, and that remote devices are managed and monitored.
-
Unsupported software
List servers whose base software no longer gets security updates, and isolate or replace them.
-
Alert response
Test who sees a high-severity multi-alert incident out of hours and what they are allowed to do.
-
Network segments
Check whether servers, workstations and admin networks are separated, so one breach does not force a full shutdown.
-
Admin credentials
Review where administrator accounts can log in, and watch for them being used from unusual places.
-
Restore order
Write down which services come back first, such as vaccination or emergency systems, and test the restore.
-
Notification duties
Know who notifies the data protection authority and by when, and what a supplier must tell you.
Where it happened
Questions
When did the Lazio attack happen?
In the night between 31 July and 1 August 2021, according to the Garante Privacy.
How did the attackers get in?
The Garante's newsletter says through an employee's laptop. LAZIOcrea says they stole a login using backdoors on a personal computer used for remote work, then reached an unpatched server. Both are company or regulator accounts of the same event, and sources differ on the exact device.
Was data stolen?
LAZIOcrea says its analysis found no flow of data to the outside and no data was published on the dark web. This is the company's statement.
What did the Garante decide?
It fined LAZIOcrea EUR 271,000, the Lazio Region EUR 120,000 and ASL Roma 3 EUR 10,000, announced on 10 April 2024.
Who was behind it?
No official attribution to a named actor. LAZIOcrea says the malware belongs to the RansomEXX family.
Did emergency services stop?
LAZIOcrea says emergency services 112 and 118, transfusion centers, emergency rooms and civil protection were never interrupted.
Sources
- Newsletter n. 521 of 10 April 2024: attack on Lazio Region IT systems, Garante sanctions Garante per la protezione dei dati personali
- Decision of 21 March 2024 on LAZIOcrea S.p.A. (doc. web 10002324) Garante per la protezione dei dati personali
- Decision of 21 March 2024 on the Lazio Region (doc. web 10002287) Garante per la protezione dei dati personali
- Decision of 21 March 2024 on ASL Roma 3 (doc. web 10002533) Garante per la protezione dei dati personali
- Valid Accounts, Technique T1078 - Enterprise MITRE ATT&CK
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.