Reported Qilin Ransomware Attack on Netalia Disrupts Genoa Fine Payments

Summary

A ransomware attack attributed to Qilin disrupted Netalia systems, preventing online payment of Genoa police fines. Data encryption is reported; exfiltration remains unconfirmed, and the city extended the discounted payment deadline.

Key points

The report attributes the ransomware attack to Qilin and says Netalia detected a malfunction at 6:55 a.m. on March 23, 2026.
The attack affected critical components of Netalia’s cloud infrastructure across multiple Italian regions, encrypting data and blocking access to company devices.
The disruption prevented online payment of Genoa local police fines; other effects remain under assessment.
Netalia’s initial checks appear to rule out data exfiltration, but the article says this has not been established with certainty.
Genoa extended the five-day payment window with a 30% discount retroactively from March 22 until systems are restored.
Netalia reported the incident, and postal police are investigating, including the possibility of a ransom demand.

Article Details

Victim Organization: Netalia Srl
Incident Type: Ransomware attack involving system compromise, data encryption, and blocked access to company devices.
Operational Impact: The attack affected critical components of Netalia's cloud infrastructure, distributed across multiple Italian regions. It prevented online payment of Genoa local police fines; the article says some archives may have been encrypted, potentially making administrative penalties temporarily unreadable. The extent of the damage was still under investigation.
Ransom Or Extortion: A ransom request was a possibility under investigation; the article does not confirm that one was received. Data exfiltration was uncertain, although initial checks appeared to exclude it. The article describes Qilin's use of publication threats in other operations but does not confirm such a threat in this incident.
Claim Status: confirmed

MITRE ATT&CK

T1486 · Data Encrypted for ImpactThe article reports that ransomware encrypted data during the attack.

People

Alessandro CarmeliThe article identifies him as the official coordinating the postal police investigation.Michele ZuninoNetalia's chief executive; the article identifies him as leading the company while its technicians assessed the damage.

Threat Actors

QilinThe article attributes the attack on Netalia to Qilin. It describes the group's broader operations as involving malware propagation, file encryption, and, in some cases, threats to publish stolen data; exfiltration and a ransom demand were not confirmed in this incident.