Westpole LockBit ransomware — Italian PA outage (2023)

On 8 December 2023, the Italian cloud and managed-services provider Westpole was hit by LockBit 3.0 ransomware at 05:00. The encryption took down the data centres in Milan and Rome that host PA Digitale's Urbi platform — and through it the digital services of approximately 1,300 Italian public administrations, including 540 municipalities, the Quirinale presidency, ISTAT, the Bank of Italy, the Ministry of Environment, and various regional bodies.

What happened

Westpole and PA Digitale together provide the digital substrate for a substantial share of Italian public administration. PA Digitale operates the Urbi platform — used by 1,300 PAs for routine workflows: payroll, citizen-services portals, document management, local-government accounting. When LockBit encrypted Westpole's hosting infrastructure, Urbi went with it.

Italy's national cyber agency, ACN, confirmed LockBit as the responsible operation within days. By 18 December, the practical concern in Italian press was straightforward: many of the affected municipalities scheduled their end-of-month payroll runs through PA Digitale, and payroll suddenly required manual workarounds.

Recovery was staged. Westpole brought back systems progressively; by mid-month, roughly 50% of systems were restored. Within the following weeks Westpole reported full data recovery for more than 700 national and local PA entities linked to the platform.

Impact

• 1,300 Italian public administrations dependent on PA Digitale's Urbi platform affected.
• 540 municipalities impacted.
• Major national bodies including the Quirinale, ISTAT, the Bank of Italy, and the Ministry of Environment affected.
• End-of-month municipal payrolls placed at risk; manual fallback required.
• Staged recovery; ~50% systems back by mid-December; full data recovery for 700+ entities reported in following weeks.

Why it matters

Westpole is Italy's reference case for shared-services supply-chain ransomware: a single MSP outage cascading into a country-wide degradation of public services. It also demonstrated, in the European context, that municipal payroll depends on the same SaaS stack as routine document workflows — meaning the operational stakes go from "inconvenient" to "people don't get paid" within weeks of an outage. The case has shaped subsequent ACN guidance on critical-supplier classification and audit obligations.