Sistemi Informativi, a company controlled by IBM and active in managing technological infrastructures for the Public Administration and large companies, is under hacker attack.
The cyber attack, revealed by Italian Tech of Repubblica, which occurred several days ago, required the intervention of internal technicians and the National Cybersecurity Agency (Acn). The extent of the damage and the possible amount of data stolen remain unknown.
“All competent institutional actors are carrying out the procedures provided by the regulations to define the contours of the attacks on the various affected systems with the aim of protecting data and ensuring services.” This was stated yesterday, May 3, by the Minister for Public Administration Paolo Zangrillo, following the hacker attack on Sistemi Informativi. “The cybersecurity agency, whose delegation resides in the Presidency of the Council, has promptly initiated all necessary actions, working to define the origin and possible impact of the attack and to understand which elements of the involved systems may have been potentially violated,” concluded the minister.
At the moment, the Sistemi Informativi website is still unreachable.
All the details.
THE HACKER ATTACK ON SISTEMI INFORMATIVI
Sistemi Informativi, controlled by IBM, was hit by a hacker attack that allegedly compromised central systems also used by the Public Administration. The news, which emerged after days of internal activity to contain the incident, was confirmed by IBM itself: “We have identified and contained a cybersecurity incident. We continue to monitor our environment while investigating the matter.”
THE COMPANY’S POSITION
For its part, Sistemi Informativi declared that it “immediately activated the incident response security protocols and involved the main internal and external cybersecurity experts to address the situation.” At the same time, the company assured that “Sistemi Informativi’s systems have been stabilized, the affected services have been restored, and we continue to monitor our environment.”
The company also specified that the “incident remained confined to the Sistemi Informativi environment.”
WHAT IS SISTEMI INFORMATIVI SRL
Founded in 1979 and acquired in the 1990s by IBM, the company acts as an operational arm for managing large technological contracts, reports Repubblica. Sistemi Informativi has about 800 employees, with its main office in Rome and branches also in Milan, Turin, Perugia, and Rieti.
With a share capital of 2.6 million euros, Sistemi Informativi is wholly controlled by the American giant.
THE GOVERNANCE
The company’s board of directors, chaired by Francesco Stronati, is composed of Gianluca Vergaretti (CEO), Pio Petricca, Stefano Brambilla, and Fabio Cesaretti.
THE FIGURES
In 2024, Sistemi Informativi recorded a production value of 87 million and 943 thousand euros, an increase of 4% compared to 2023, also thanks to the growth of other revenues and income, which benefited from higher cost recharges to other group companies compared to 2023.
Specifically, revenues stand at 84 million and 969 thousand euros, substantially in line with the previous year, while considering this item together with the variation in work in progress on orders, there is an annual increase of 3%. “This trend is attributable to business dynamics, particularly the good performance of system consulting activities, while the cybersecurity sector shows a year-on-year decline, driven by the closure of some significant contracts,” explains the company.
Production costs amount to 79 million, substantially unchanged compared to the previous year. The company boasts total tangible fixed assets valued at one million euros.
The 2024 financial year closes with a profit of 5.6 million euros, up from 2023 (3 million euros), and debts amounting to 26 million euros.
THE DEBT COMPOSITION
Specifically, debts to suppliers amount to 9 million and 455 thousand euros and represent the debt position towards third-party suppliers. It is noted that debts to the parent company IBM Italia S.p.A. at the end of 2024, amounting to 7 million and 244 thousand euros, relate to commercial items for 4 million and 494 thousand euros, and to tax-related matters, for 2 million and 750 thousand euros.
Debts to social security and welfare institutions, amounting to 2 million and 383 thousand euros at the end of the year, concern commitments to public institutions for contributions to be fully paid within the following year. They mostly consist of contracts with INPS, amounting to 1 million and 985 thousand euros, and other entities (including Fon.Te, Previndai, and EST) for 398 thousand euros. At the end of 2023, this item amounted to 2 million and 186 thousand euros, of which 1 million and 837 thousand euros referred to debt towards INPS.
THE ROLE IN THE PUBLIC ADMINISTRATION
Sistemi Informativi represents a central node in Italy’s digital infrastructure. It operates with the Public Administration at national and local levels, as well as collaborating with entities such as INPS and INAIL. Its activities include consulting, software development, cloud, system integration, and cybersecurity. It is also a technology partner for financial groups, energy companies, and telecommunications companies.
Through the Consip platform, numerous contracts linked to ministries, digital health, national cloud, and PNRR projects emerge, demonstrating its role in the country’s critical infrastructures, reports Repubblica.
THE SALT TYPHOON GROUP BEHIND THE CYBER ATTACK
According to journalistic reconstructions, behind the attack is Salt Typhoon, a group associated by Western intelligence with cyber espionage activities linked to China, a connection officially denied by the Beijing government.
Salt Typhoon is classified as an Advanced Persistent Threat (APT) and operates with the goal of gathering sensitive information through prolonged and hard-to-detect access. It does not use destructive techniques or ransom demands but aims to remain in systems as long as possible to extract data.
WHAT THE INTERNAL INVESTIGATION FOUND
However, IBM states that “based on our investigation to date, we do not believe this activity is attributable to Salt Typhoon. Consistent with industry best practices, we do not attribute the activity to a specific group, recognizing that formal attribution requires evidentiary standards and intelligence sources beyond forensic technical analysis alone. However, following consultations with internal and external cybersecurity experts and partners, we assess that the observed activity is consistent with sophisticated cyber espionage behavior.”
CONTAINMENT OPERATIONS
And now cybercriminals have attacked Sistemi Informativi to target the Italian Public Administration.
For about two weeks, internal technicians and specialists from the National Cybersecurity Agency have been engaged in cleaning up compromised systems. Activities include identifying the attackers’ access point and securing the entire infrastructure.
It is currently unclear when the communication to the competent authorities was made, nor how long the hackers had been present in the systems.
“NO PUBLIC SECTOR CLIENT HAS BEEN COMPROMISED”
According to IBM, “the investigation has not identified any compromise of data or systems of public sector clients. All Sistemi Informativi clients have been informed of the containment measures and kept updated on the investigation’s results, including the conclusion that no public sector client was compromised.”
However, the overall scope of the attack remains to be clarified, in a context where the affected company manages data and fundamental services for the functioning of the Italian Public Administration’s digital system.
THE PUBLIC SECTOR (ESPECIALLY HEALTHCARE) IN THE SIGHTS OF CYBER PIRATES
Finally, the incident once again highlights how the Italian public sector is a prime target for cybercriminals, particularly in the healthcare sector.
In April 2024, the Italian Privacy Authority imposed fines following proceedings opened after the cyber attack on the Lazio regional health system that occurred on the night between July 31 and August 1, 2021. LAZIOcrea (the company managing regional IT systems), the Lazio Region, and ASL Roma 3 will have to pay 271,000, 120,000, and 10,000 euros respectively.
Another episode dates back to May 3, 2023, when a hacker attack caused the shutdown of the ASL 1 Abruzzo IT system, as communicated by the health company itself. In addition to service and performance interruptions, there was a serious privacy breach, with the online dissemination of reports and tests of patients from the ASL Avezzano-L’Aquila-Sulmona.
