In three recent decisions, the Italian Privacy Authority sanctioned the Lazio Region after a ransomware attack suffered in the summer of 2021 that caused a shutdown of the regional healthcare system and prolonged disruption even for several months.