Loading story…
Sapienza University of Rome (La Sapienza) suffered a major cyber incident that forced the institution to take critical IT systems offline, leaving core digital services disrupted for several days and the university website unavailable. The university publicly acknowledged the attack via social media, stating it shut down systems as a precaution to protect data integrity while it investigated and worked to restore services; it also indicated some channels (including email and workstations) were only partially available and that recovery efforts were proceeding using backups believed to be unaffected.
Italian authorities were notified and Italy’s national cybersecurity agency (ACN) is reported to be investigating. While the university has not formally attributed the incident, Italian media reporting cited by both outlets described the disruption as consistent with a ransomware operation, including claims that attackers provided a ransom-demand link featuring a 72-hour countdown that begins only after the link is clicked; separate reporting also linked the activity to BabLock ransomware, though this attribution has not been officially confirmed. To reduce impact on students and staff during the outage, the university also set up temporary in-person “infopoints” to provide access to information normally delivered through unavailable digital systems.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
By 2026-02-07, the university was still keeping IT systems offline while technicians and investigators worked to determine the full scope of the breach and whether backups would support full recovery. Public reporting said operations were still significantly disrupted.
As outages continued, La Sapienza said exams would proceed, with students registering directly through professors, and established on-campus infopoints to assist users. These measures were introduced to maintain essential academic operations during the disruption.
The university said it was investigating the incident and restoring services from backups that were not affected by the attack. Some services, including email, workstations, and the website, remained limited or offline during the recovery.
Follow-on media reports attributed the incident to a previously unknown or purported pro-Russian group called Femwar02 and linked the malware to BabLock, also known as Rorschach. Neither the university nor Italian authorities publicly confirmed this attribution at the time.
Early reporting on the incident said the attackers sent a ransom-demand link tied to a 72-hour countdown that would begin only if the link was clicked. The university reportedly avoided engaging with the demand while assessing the situation.
Following the attack, La Sapienza notified Italy’s National Cybersecurity Agency (ACN) and law enforcement, which began coordinating on the response and investigation. ACN was publicly identified as involved in the case as recovery efforts started.
On 2026-02-02, La Sapienza University in Rome shut down its network systems as a precaution after a cyberattack disrupted operations. The university said the move was intended to protect data integrity and prevent the threat from spreading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcethecyberexpress.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026
Romania’s National Administration of Penitentiaries (**ANP**), which oversees the country’s prison system, was hit by a ransomware attack that affected multiple workstations and servers. Romanian media reported that the incident forced the institution to take several digital services offline as a precaution, while internal teams worked to contain the intrusion and prevent further spread across the network. ANP notified Romania’s National Directorate for Cyber Security (**DNSC**), which joined the response effort to help limit the impact and support remediation. Public reporting indicates the attack disrupted administrative systems, but no threat actor, ransomware family, or technical indicators of compromise were disclosed at the time of reporting.
Aug 2, 2026