Azienda Ospedaliero-Universitaria SS. Antonio e Biagio e Cesare Arrigo – €25,000 Fine (Italy, 2024)

A university hospital, the controller, experienced a ransomware attack by the "Ragnar Locker" group. The attackers exploited a vulnerability in the controller's firewall to obtain domain credentials belonging to a supplier. Using these compromised credentials and a VPN connection, the attackers performed lateral movements (i.e. they moved sideways from device to app and so forth to explore infected networks to find vulnerabilities, escalate access privileges, and reach their ultimate target) within the network and eventually gained access to the controller's shared file server, which, although intended only for administrative documents, contained various files including health data. The attackers successfully exfiltrated data to servers in the Netherlands and established a backdoor Secure Shell (SSH) connection. They disabled the antivirus system and deployed executable code that spread ransom notes across workstations, though they did not encrypt the data. The controller promptly notified the DPA about the breach. First, the DPA held that the controller violated Article 5(1)(f) GDPR (integrity and confidentiality principle) and Article 32 GDPR by failing to implement adequate measures to detect data breaches promptly. The controller lacked a proper log management system that could have enabled early detection of the suspicious activities that preceded the attack. Second, the DPA found that the controller's network security measures were insufficient. The authority noted several critical vulnerabilities: the network had no segmentation, VPN access lacked multi-factor authentication, maintenance accounts used shared administrator credentials, and approximately 130 users possessed maximum administration rights. Additionally, the controller continued to run obsolete communication protocols. The DPA considered several mitigating factors under Article 83(2) GDPR: the controller's prompt breach notification, full cooperation during the investigation, implementation of