When two and a half days of silence cost everything
November 25, 2022, time unknown. Someone gets into CAMST’s network. No alarm.
CAMST is not a small company. It is one of Italy’s largest cooperative businesses in contract catering: workplace canteens, hospitals, schools, airports, universities. Thousands of employees. Tens of thousands of meals a day. An IT infrastructure to match.
And yet someone gets in. Looks around. Gets to work.
For two and a half days, nobody notices.
How it went down
On December 30, 2022, a month after the attack, the Hive Ransomware group sends an email to the editorial team of Red Hot Cyber. They want to tell how it went down. The editors decide to publish it in the interest of the professional community, because in Italy, they write, nobody ever does lessons learned.
What follows is drawn from that source.
“We began the attack against them on November 25 and finished it on the evening of November 27.”
Friday, Saturday, Sunday. A whole weekend, in full operation, because CAMST never stops. Hospital canteens never stop. Schools need their meals on Monday. The infrastructure running all of this was in the hands of Hive Ransomware, and nobody knew.
“It wasn’t hard for us to connect to the domain controller of their network and pull all the system information to examine in detail how everything was configured, and it didn’t take long, because everything was configured in a standard way.”
Standard. There was no trap. No anomaly that would ring. A normal network.
Once inside, with access to the domain controller, Hive Ransomware says it removed the Sophos antivirus “without any problem” and copied 370 gigabytes in about forty minutes.
Contracts, sensitive data, payment data, internal documentation. Out the door, in absolute silence.
Then the encryption begins. Slow, methodical, relentless.
“Only on the evening of November 27 did they discover our presence, when 99.9% of the network had already been encrypted.”
99.9%.
Not a single alarm beforehand. Not one.
What happened next
Hive Ransomware contacts the company and sets a deadline of December 30 for the ransom payment. The company doesn’t pay, a choice in line with what the authorities recommend. Hive Ransomware says it received no reply to its messages before the deadline.
On December 30, Hive Ransomware publishes everything. Not a part, everything. All 370 gigabytes of exfiltrated data end up on Hive Ransomware’s data leak site, accessible through the Tor browser by anyone. Not just by hackers. By anyone with a computer and the will to download it.
Among that data were the company’s cyber insurance policies. That is not a minor detail.
Cyber policies contain a detailed description of the insured infrastructure: which systems, which risks covered, what limit. They are, in essence, a map of what the company itself declares it has and what it’s worth. In the hands of whoever is negotiating a ransom, they are a precise instrument of pressure.
Hive Ransomware says so explicitly in its email to Red Hot Cyber: “They understood that we knew they had insurance.” They didn’t deduce it from the outside: the policy was most likely in the network itself, stored like any other company document, within reach of someone who already held the domain controller.
Those same documents, together with employee data (personal documents, salaries...), user passwords, customer payment data, administrative documents, and records of dealings with suppliers and customers, were published in full on the dark web on December 30, downloadable by anyone. Hive Ransomware’s site was seized by law enforcement on January 26, 2023, almost a month later. But no seizure can call back data that has already been downloaded.
Press coverage at the time focused on the operational disruption: a few days of slowdowns, then everything back to normal. The story of the data published on the dark web did not receive comparable public attention.
The question that remains
CAMST was not a negligent company. It had an antivirus and the defenses of a large organization. The question is not why it failed to stop Hive Ransomware at the door: it was already inside, with valid credentials, moving like an administrator.
The question is a different one: in those two and a half days, what should have rung?
In a network configured in a standard way, the honest answer is: nothing. The antivirus was removed “without any problem.” An administrator’s traffic and that of someone who stole their credentials are indistinguishable. Nobody had placed anything in the network designed to notice who was already inside.
Today this question also has a regulatory side.
In November 2022, the NIS2 Directive was not yet in force in Italy. Today it is, transposed by Legislative Decree 138/2024. For the entities within its scope, it sets precise obligations in the event of a significant incident: an early warning to the competent CSIRT within 24 hours, a fuller notification within 72 hours, a final report within one month. These are not recommendations. They are obligations, with explicit management accountability. But anyone who discovers an attack after two and a half days is already late: you can’t report within 24 hours what you haven’t seen.
Separately, the GDPR imposes a different but equally relevant obligation: when a breach poses a high risk to people’s rights, as with employees’ personal data published on the dark web, the company must notify the individuals concerned directly, not just the authorities.
And then there are the people.
Employees’ personal data doesn’t belong to the company that holds it. It belongs to those who generated it by working, signing contracts, receiving paychecks. When it ends up on the dark web, the damage is real and personal, and it lasts far longer than a few days of disruption at the canteens.
Cases like this deserve to be told not to point a finger, but so that those who work in a company, who run IT, who sit on boards, understand what it concretely means when an incident really happens. Not in terms of logs and firewalls. In terms of real people, real data, real consequences.
That evening of November 27, for CAMST, the answer to “what rings?” was: nothing. The answer now is yours.
Sources: Red Hot Cyber, January 2023; United States Department of Justice, January 26, 2023.