On December 8, 2023, a cyberattack hit the Italian cloud services company Westpole, which specializes in digital services for public bodies. The incident affected a Westpole client company called PA Digitale , which offers its services to various local and government organizations based on the Urbi platform . PA Digitale provides its services to 1300 public services, including 540 municipalities.
See also: Over 40 countries to sign to stop paying ransoms to ransomware gangs
The company has notified the Italian data protection authority Garante della Privacy and the Italian police, who are investigating the cyberattack. According to sources with knowledge of the matter, Westpole was the victim of a ransomware attack. The attackers used the Lockbit 3.0, but the company is not currently listed on the Lockbit.
The attackers used the Lockbit virus to attack PA Digitale and the attack paralyzed the services of many public administrations and municipalities. Several municipalities were forced to return to manual operations to provide some services. The Italian cybersecurity agency “Agenzia per la Cybersicurezza Nazionale (ACN)” is currently working to recover the data for the affected entities.
In the past few hours, some Italian media reported that the attack could affect the payments of December salaries to employees in some of the affected government agencies.
It is difficult to assess the extent of the damage caused by the ransomware attack. According to Italian media outlet La Repubblica, Westpole has only managed to restore 50% of its systems. ACN points to a slow and challenging recovery process, raising uncertainty about the company's ability to fully restore the affected systems. Experts warn that affected public administrations may face difficulties in fulfilling certain services and obligations towards their employees.
See also: McLaren Health Care – Blackcat ransomware: Patient data leak on the dark web?
Immediately after the Westpole attack was revealed, the cloud service provider stated that no data was leaked from its systems. However, if the ransomware attack is confirmed, it is hard to believe that an advanced team like Lockbit 3.0 would refrain from leaking any data.
At the moment, the only certainty is that the attack on Westpole is the most serious that the Italian public administration has suffered to date.
One of the key steps to countering a ransomware attack is user education. Users need to be informed about ransomware threats and know how to recognize suspicious emails or websites that may contain malware.
Another important step is to install up-to-date antivirus software. A reputable antivirus program can detect and remove malware before it can do any damage. It's also important to keep your operating system and applications up-to-date. Updates often include security improvements that can protect your system from vulnerabilities that attackers exploit.
See also: BlackCat ransomware: Claimed responsibility for attack on Florida courts
Another important step is to regularly back up your important data. If you fall victim to ransomware, backups can help you restore data without paying a ransom.
Finally, being careful about downloading and using assignments can help prevent ransomware attacks. You should be cautious when accessing assignments from unknown sources and avoid installing assignments from untrusted sources.
Source: securityaffairs
