Ransomware Cyber Attack Liability: an Italian Court Leaves Half of the Loss With the Client

Ransomware liability in Italy now the first Italian court that responded to the question on whether the IT provider that managed the systems has to pay for damages caused by the cyber attack.

An Italian court of first instance, the Court of Varese, First Civil Section, in judgment No. 545/2026, holds the provider in breach, terminates the contract, and still leaves the largest share of responsibility with the client as data controller. Of the EUR 242,310 claimed, the manufacturing company recovers EUR 20,000.

The facts

In September 2023 a manufacturing company suffered a ransomware attack. Data were encrypted, operations halted, and the CRM and part of the ERP files were lost permanently, because they had never been included in the backup scope.

The company sued the provider that had managed its infrastructure since 2017, seeking to put the whole of the loss on the supplier. The claim alleged an outdated firewall, a server exposed with intrusion prevention only, incomplete backups, a flat network and a slow, inadequate incident response. It sought termination of the contract and EUR 242,310 in damages for business interruption, staff time spent on recovery, technical and legal costs and reputational harm.

The provider’s defence was narrow and, on its face, strong. There had been no global outsourcing, only on-call support for one server and seventeen workstations, for an annual fee of EUR 1,500. A fee of that size describes the scope of the engagement better than any clause, and the provider built its whole case on the disproportion between the fee and the loss.

Ransomware liability attaches to the de facto system administrator

The decisive issue was how to characterise the provider’s role. The relationship rested on a set of separate contracts covering Wi-Fi and firewall, technical support, a new server, Exchange mail and Nextcloud. All of them were drafted in generic terms and none of them mentioned backups, data loss or security. The provider had also never been formally appointed as system administrator under the Italian Data Protection Authority’s measure of 27 November 2008, which requires controllers to designate those figures by name and to retain their access logs.

The Court looked past that formal gap. Whoever manages systems and networks with privileged access acts as a de facto system administrator, appointment or no appointment. The court-appointed expert described a three-pillar model: the company as data controller; the provider, with functions and access equivalent to an external system administrator despite holding no formal role; and further third parties holding comparable administrative credentials.

That characterisation carries two consequences. A support contract with no advisory component is still assessed as systems support. The provider’s conduct is measured against the heightened professional diligence standard of Article 1176, second paragraph, of the Italian Civil Code, meaning the technical knowledge and the best practices expected of a professional IT operator rather than those of a careful layperson. On that standard the Court found breach and terminated the contract under Articles 1453 and 1455.

The principle is the same one that decides exposure when a connected product or an outsourced platform fails: responsibility follows actual control over the system, not the label on the agreement, as the allocation between manufacturer, operator and maintenance contractor in the recent French refrigeration case also shows.

The controller’s own fault cuts the recovery in half

The provider’s liability was not exclusive. The entry point of the attack could not be identified with certainty, and the expert attributed the event to shared responsibility arising from three factors: no unified IT governance, inadequate access logging, and several parties operating simultaneously with administrative privileges.

Applying Article 1227 of the Civil Code, the Court adopted the expert’s allocation: 50 per cent to the victim company, 30 per cent to the provider, 20 per cent to the other parties holding privileged access. A data controller may outsource systems management. It may not outsource the duty of oversight, or the organisational and security measures that the GDPR requires of it.

Two features of that allocation matter more than the percentages. The inability to identify the entry point worked against the party that should have been able to reconstruct it, which means the party with no usable logs. And the 20 per cent attributed to third parties sits with nobody: those parties were not in the proceedings, so that share is simply lost to the claimant. A victim that sues one of several privileged-access holders therefore caps its own recovery before the merits are reached, a problem that recurs whenever several providers share control of the same environment.

The Italian Data Protection Authority reached findings of the same kind, from the regulatory side, in its decision No. 529 of 14 July 2026 against an engineering company, where the first contested failing was the absence of multi-factor authentication on the VPN and the further failings concerned backups reachable from the compromised network, insufficient segmentation and the absence of formalised vulnerability management. The civil and the regulatory analyses now converge on the same short list of controls.

Loss established, amount not proved

The harm was established, and its measure was not. The Court examined each head of damage and rejected almost all of it.

1. Business interruption. An analysis of orders lost, recovered or cancelled was needed. The turnover figures produced were inconsistent with each other.
2. Staff costs. Payslips do not show the hours spent on recovery. Payroll is an ordinary cost, and it becomes recoverable loss only on evidence of overtime, temporary hires or productive work actually forgone.
3. Technical and legal costs. Only certain specialist advisory fees were linked to the attack. Moving to new providers was a business decision and not a consequence of the breach.
4. Reputational harm. It is not presumed. Emails from clients worried about their own data prove concern, not lost reputation or lost business opportunities.

Witness evidence was refused, because at most it could have confirmed liability, which was not in doubt, and not quantum, which was. The Court therefore assessed damages on an equitable basis under Article 1226 of the Civil Code at EUR 20,000, weighing the recovery costs identified by the expert, the provider’s degree of fault and the company’s own contribution. As a further benchmark it referred to its own settlement proposal under Article 185-bis of the Code of Civil Procedure, for the same figure, which the provider and its insurer had accepted and the claimant had rejected. Legal costs were offset and the expert’s fees split equally.

That last detail is the one to remember, because the claimant turned down EUR 20,000, litigated, won on liability and was then awarded EUR 20,000 while carrying its own costs and half of the expert’s fees, which tells us that the law applied was never the difficulty in this case and the evidence file always was.

An insurance policy that did not respond

The provider had joined its insurer to the proceedings. The policy covered civil liability for electronics business and for installation at third-party premises. The conduct in issue concerned security management, backups and incident response, none of which is hardware or software installation. The indemnity claim was dismissed and the provider was ordered to pay the insurer’s legal costs as well.

The provider therefore lost twice on the same facts: once to its client, and once to the insurer it had expected to stand behind it. Policies written for an installation business do not extend to the management of somebody else’s infrastructure once that business starts providing it, and the mismatch surfaces at the worst possible moment, after the loss and inside the litigation.

What ransomware liability now requires of data controllers

Four requirements follow for a company that has outsourced the management of its systems and would like the loss, if one ever comes, to sit where it belongs.

1. Scope stated in writing. The contract must say who handles backups, patching, firewall configuration, monitoring and incident response. Silence on those points did not protect the provider here, but it halved the client’s recovery, because an unwritten scope is also an unproved one.
2. System administrators designated and logged. Privileged credentials must be mapped, the holders designated by name, and the access logs kept in tamper-proof form. The absence of usable logs is what prevented the entry point from being identified, and the party that cannot reconstruct the event is the party that carries the doubt.
3. Unified governance. One internal owner must coordinate the providers and review their work periodically. The expert treated the absence of that role as a cause of the attack and not as an administrative shortcoming.
4. Loss recorded as it occurs. Orders lost, recovery hours, overtime and external costs have to be captured while the incident is running. Every head of damage rejected in this case was rejected for want of a document that existed only in the days after the attack, when nobody was creating it.

The weight of those requirements is increasing. Governance and logging are no longer matters of good practice for the many Italian companies inside the national cybersecurity perimeter: they are obligations, with deadlines and inspection powers attached, as set out in the Italian implementation of NIS2. The same facts tried in two years’ time would expose the controller to an administrative proceeding alongside the civil one, and the regulatory findings would then do the claimant’s work for it, or the defendant’s.

What the judgment now requires of IT providers

Four requirements follow on the other side of the relationship, where the exposure is considerably harder to contain than the size of the fee would suggest.

1. Contracts that match the service actually supplied. A provider that manages the infrastructure answers as a system administrator whatever the agreement is called, and a modest annual fee does not reduce the standard of diligence. It reduces only the revenue available to absorb the claim.
2. Backup scope agreed and tested. The permanent loss in this case concerned files that had never been inside the backup scope. The scope must be agreed in writing, restore tests must be provided for, and liability caps must be set within the limits of Article 1229 of the Civil Code, which leaves gross negligence outside any cap.
3. Insurance checked against the real activity. A policy covering installation does not cover systems management, and the gap is discovered in the litigation rather than before it.
4. A written incident procedure. Roles and timelines must be agreed with the client in advance. The allegation of a slow and inadequate response was the easiest part of the claim to make, because there was no agreed procedure against which the response could be judged.

The judgment leaves the most useful lesson unstated. The claim succeeded on liability because the contracts said nothing about security, and they said nothing because the conversation about scope is an awkward one to have while selling a EUR 1,500 support arrangement.

Ransomware liability is decided in the first days after the attack

The judgment confirms that responsibility follows actual control over the systems, and that the words chosen to describe the engagement count for very little when the loss arrives. It also shows how a claim of more than EUR 240,000 becomes an award of less than a tenth of that figure, and the reduction has nothing to do with the law applied.

Liability was never seriously in doubt once the expert had characterised the provider’s role. What failed was proof of loss, and every document that would have proved it had to be created during the week of the attack: the list of orders cancelled, the hours booked to recovery rather than to production, the invoices attributable to the incident and not to the decision to change supplier, and the logs that would have shown how the attacker entered. Incident response consumes all of those, because its purpose is to restore service, and restoring service overwrites the evidence of what the loss was and whose fault it had been.

All of this cuts against the way incidents are usually run. The claim against whoever left the system exposed is often worth more than the insurance recovery, and it is the one asset the first seventy-two hours routinely destroy. Preserving it costs very little at the time, provided somebody has decided in advance who writes things down while everyone else restores backups.