Cyberattackers shut down vaccine bookings for Rome and its region

By Emma Bubola


The Lazio region of Italy, which includes Rome, has been unable to offer vaccination appointments online for three days because of a cyberattack on its website over the weekend, part of what the authorities said was probably Italy’s most serious ransomware case to date.


Ransomware attacks, in which criminals break into a computer system, encrypt the data it contains and demand money to release it, have struck health care systems in many countries, paralyzing hospitals, clinics and testing centers from California to Ireland and New Zealand. The attack in Italy is one of the largest to affect a vaccination campaign, raising alarms about its potential effect.


“It’s hitting one of the things that in 2021 are fundamental,” said Stefano Zanero, a professor of cybersecurity at the Polytechnic University of Milan.


The attack against the regional information technology services began at midnight on Saturday. It came at a fraught time, as the Italian authorities are grappling with vaccine skepticism and the spread of the delta variant, which is dominant in the country.


Italy’s postal police, who have jurisdiction over cyberattacks, are still investigating the identity of the attackers, but the president of the Lazio region, Nicola Zingaretti, said on Monday that the police knew it had come from abroad. He called the attack “very powerful and very invasive.”


A ransomware attack in May on the Colonial Pipeline, which transports fuel from Texas across the southeastern United States as far as New Jersey, caused a shutdown that lasted several days and prompted panic buying of gasoline in the United States. In Ireland, an attack paralyzed the health services’ digital systems for more than a week in June, delaying COVID-19 testing and medical appointments.


Italy’s regional governments have extensive powers over vaccinations in Italy, and the Lazio region, home to nearly 6 million people, prided itself on an efficient campaign. About 70% of the region’s adult population is fully vaccinated, the highest figure in the country; for Italy as a whole, the figure as of Tuesday was 53%, according to a New York Times tracker.


Vaccinations are going ahead in Lazio, and the 500,000 people who had booked appointments before the cyberattack will still receive their shots, the authorities said. After Aug. 13, though, the region’s vaccination schedule is empty. Alessio D’Amato, the region’s top health care official, said that bookings would become available again by the end of the week.


Several other public services have also been affected by the attack, including health care appointments, but the authorities said personal health and financial information had not been breached or stolen. Residents can still download the health pass that will be required for many social activities starting Friday.


Some vaccination sites in the region are offering shots without appointments, including one at the Rome-Fiumicino International Airport, and officials are sending vans to distribute shots in remote villages. But their capacity is limited.