LAZIOcrea S.p.A. – €271,000 Fine (Italy, 2024)

On the night of 31 July 2021, a cyber-attack occurred in the healthcare system of the Lazio region, Italy. It had some serious repercussions causing local health authorities, hospitals and nursing homes ('the controllers') being unable to use regional information systems for hours and in some cases even for months. Essential services related to the emergency activities were not interrupted as they were separeted from other applications. The ransomware attack originated in March 2021 on a computer of a regional employee working remotely for one of the entities. The employee installed a malicious software necessary to connect to the processor’s network. The software created a backdoor to the system stealing the employee’s access credentials. LAZIOcrea S.p.a. was a company responsible for the management and security of the information systems of Lazio Region pursuant to Article 28 GDPR (‘processor’ or ‘company’). The attack targeted machines located in one of the rooms of the data center managed by the company. The company was therefore also acting as a controller for its own purposes, as the operating systems which were attacked also managed additional processing activities. The company did not notify the data breach immediately but with considerable delay and in any case beyond 72 hours as required by Article 33 GDPR. The data breach was notified to the affected controllers about two weeks after the incident, lacking specific references to the attacked processing systems which would have been beneficial for each controller to delineate the extent of the breach and evaluate associated risks. The notification of the data breach itself did not document necessary information about the attack such as, i.e. date and time of closure of the incident, date and time of resolution of the incident, person who detected the incident. Moreover, some of the information provided was inaccurate, i.e. description of the incident, the response actions carried out. Due to this, the Italian DPA (‘Garante’) had to act ex officio following press reports regarding the facts in question and notifications presented by various data controllers involved. The investigation revealed that the company did not adopt several security measures. Firstly, at the time of the incident, the company did not have staff dedicated to a 24-hour analysis of the alerts generated by Microsoft’s SIEM, the security monitoring system. Secondly, the company did not separate the networks for employee’s accounts and servers used for various processing operations carried out. Thirdly, although the filtering rules on the firewalls in the data center managed by the company were set up to target specific critical systems, they failed to stop the malware from spreading to around 180 systems. Fourthly, the attackers succeeded due to a vulnerable authentication procedure for remote system access, relying solely on username and password credentials and the company’s failure to update its operating system creating additional vulnerabilities. It also emerged that the temporary unavailability of access to data processed through the mentioned healthcare facilities was, on the one hand, a direct consequence of the cyber-attack and, on the other hand, an indirect consequence of the subsequent actions by the company. In fact, the company decided to shut down all the server systems which disabled them from determining which ones were compromised. Additionally, given the absence of the system separation, it could not prevent further spread of the malware. As part of its defence, the company represented that it performed annual internal audits based on the certification process of the Information Security Management System. The company also declared that prior to the accident, the system information security was implemented in compliance with the industry standards certification ISO/IEC 27001. The investigations conducted by the Garante revealed a series of serious violations by the company. Firstly, the Garante determined that the company acted in the role of a controller of its own operating systems which were also a target of the cyber-attack. For this reason, it failed to fulfil its obligation under Article 33(1) GDPR to report the breach to the DPA within 72 hours since the moment it became aware of it. In addition to that, the DPA determined that as a processor, the company was obliged to report the incident to all the controllers affected by the breach as per Article 33(2) GDPR. The company failed to provide adequate justifications regarding the reasons for the above-mentioned delays. As a result, the DPA found a violation of Article 33 GDPR. Secondly, the DPA noted that the company failed to adequately document the violation as the report contained incomplete information regarding the data breach and its handling. Such behavior was also not in line with the company's own data breach management policies which provide for the keeping of an events register on reports of alleged breaches. The DPA thus found a breach of obligations under Article 33(5) GDPR. Thirdly, the lack of various security measures, such as assigning personnel for system security monitoring, separating operational networks, or reinforcing filtering rules on the firewalls within the data center, led to various vulnerabilities. Exploited by attackers, these vulnerabilities provided access to the company's operating systems which, as discovered after the attack, were outdated. In this regard, the DPA highlighted that the processing operations carried out in this context require the adoption of the highest security standards. The company argued that its information security system is in compliance with the ISO/IEC 27001 certification standards. However, the DPA noted that such certification is not, at the moment, among those envisaged by Article 42 GDPR. The certification can be used as an element to demonstrate compliance with the GDPR obligations and show that an organization has identified and implemented certain security controls. However, it does not guarantee predefined security levels or measures. For these reasons, the Garante found a violation of the processing principle under Article 5(1)(f) GDPR and Article 32 GDPR related to the security of processing which was compromised by the company in its capacity as a controller and processor. The DPA imposed a fine of a €271,000 to the company for the failure to report the data breach and a lack of security measures adopted to the processing operations conducted on such wide scale.