ASL 1 - Avezzano Sulmona L'Aquila *UPD 05-11* Listed by monti Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Healthcare organisations across Europe have faced sustained pressure from ransomware groups that combine system disruption with data theft. In this landscape, local health authorities holding large volumes of clinical and administrative records have become frequent targets, not only for the operational leverage they offer but for the sensitivity of the information they manage.

On 11 May 2023, the Italian local health authority Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila was listed by the monti ransomware group. Public reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The number of people affected remains unknown, and many operational details have not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope has not been made public.

Inside the incident

According to available reporting, the organisation appeared on monti’s leak site under the headline referencing ASL 1 – Avezzano Sulmona L’Aquila, with an update notation dated 05-11 and a report date of 11 May 2023. The summary associated with the listing points to the institutional portal asl1abruzzo.it. The only data category named is “internal files exfiltrated in a ransomware attack.” No public figure has been given for the volume of data, the number of individuals affected, or the precise method of initial access. Timing of the intrusion itself, beyond the May 2023 listing date, is undisclosed. Whether systems were encrypted, how long any disruption lasted, or whether negotiations occurred has not been detailed in the material available for this account.

In short, the confirmed public record is limited to the group’s claim of a successful ransomware operation involving exfiltration of internal files from the health authority. Everything else—scale, dwell time, specific systems compromised—remains unconfirmed in open sources.

The group behind it: monti

Monti is a ransomware operation that became active in the period following the disruption of the Conti group. Like many successors in that ecosystem, it has been observed using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if payment is not made. The group maintains a leak site on which it names victims and, in some cases, releases samples or larger archives of stolen material. Public reporting has linked monti to attacks across multiple sectors and geographies, often focusing on organisations whose downtime or data exposure creates strong pressure to pay.

In this instance, monti’s listing of Azienda Sanitaria Locale 1 Avezzano Sulmona L’Aquila constitutes the group’s claim that it conducted the attack and obtained internal files. No further statements attributed specifically to monti about this victim—such as ransom demands, file counts, or deadlines—appear in the facts at hand. Readers should treat the leak-site entry as an unverified assertion by the threat actor unless corroborated by the organisation or independent investigators.

Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila and its sector

Azienda Sanitaria Locale 1 Avezzano Sulmona L’Aquila is a local health authority in the Abruzzo region of Italy. Such ASL entities are responsible for delivering and coordinating public healthcare services across their territories, including hospitals, outpatient clinics, preventive medicine, and administrative functions tied to patient care. Their institutional portals typically serve as public-facing gateways for information, appointments, and official communications.

Organisations of this type routinely process and store substantial volumes of personal and health-related data: patient demographics, clinical records, appointment and referral information, staff records, and operational documents. A breach affecting an ASL is consequential because it can interrupt care delivery, erode public trust in regional health services, and place sensitive personal information at risk of misuse. Even when clinical systems themselves are not confirmed as compromised, the theft of internal administrative files can still expose identifiers and other details that enable further harm.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data types—such as medical records, identity documents, financial details, or employee information—has been publicly itemised. Exact contents therefore remain unconfirmed.

In general, local health authorities hold patient master data, clinical documentation, billing and insurance-related records, workforce information, and internal correspondence and operational files. Any of these categories could theoretically be present among “internal files,” but it would be inaccurate to assert that particular classes of data were definitely taken. Until the organisation or competent authorities publish a clearer accounting, the precise nature and volume of exposed material should be regarded as unknown.

Why it matters

For individuals whose information may have been among the stolen files, the practical risks include identity misuse, targeted phishing that references real health or administrative details, and longer-term concerns about the confidentiality of medical or personal history. Even partial records can be combined with data from other breaches to build more convincing fraud attempts.

For the organisation, the incident raises questions of operational continuity, regulatory notification obligations under European data-protection rules, and the cost of investigation, remediation, and potential patient notification. Public listing by a ransomware group can also affect reputation and public confidence in the security of regional health services. Because the number of people affected is unknown and the exact data types are undisclosed, the full scale of individual and institutional impact cannot yet be measured from open sources alone.

What to do if you're exposed

If you have been a patient, employee, or service user of Azienda Sanitaria Locale 1 Avezzano Sulmona L’Aquila, treat the possibility of exposure seriously even while details remain limited. Monitor official communications from the health authority for any notification or guidance. Watch financial and email accounts for unusual activity, and be cautious of unsolicited messages that claim to relate to your care or to this incident. Consider placing fraud alerts with relevant credit or identity-protection services if you believe sensitive identifiers may have been involved. As a practical additional step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which may help you decide what further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.