Loading story…
Italy’s Data Protection Authority fined Intesa Sanpaolo €31.8 million after finding that the bank failed to adequately protect customer banking data from unauthorized internal access. The investigation, opened after a July 2024 breach disclosure, found that an employee improperly accessed the records of 3,573 customers and carried out more than 6,600 consultations between February 2022 and April 2024. Regulators said the bank’s technical and organizational safeguards were inadequate and that its operating model granted excessively broad access across the customer base.
Authorities said the activity went undetected because of weaknesses in the bank’s monitoring and prevention systems, and they noted that some affected customers were high-profile public figures who should have received enhanced protection. The regulator also criticized Intesa Sanpaolo for incomplete and delayed notifications to affected customers after the breach, while noting that remediation steps later taken by the bank to strengthen internal controls and data security safeguards were considered in setting the penalty.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Italy's Data Protection Authority imposed a €31.8 million fine on Intesa Sanpaolo after concluding the bank failed to adequately protect customer banking data from unauthorized internal access. The authority said the bank's technical, organizational, and monitoring controls were inadequate.
After the breach, Intesa Sanpaolo introduced corrective actions to strengthen internal controls and data security safeguards. The regulator said these later remediation steps were taken into account when setting the penalty.
In July 2024, the breach was disclosed, leading Italy's Data Protection Authority to open an investigation into the bank's handling of customer data and internal access controls. The regulator later criticized the bank's notifications to affected customers as incomplete and delayed.
The improper access continued through April 2024, ultimately involving the data of 3,573 customers and more than 6,600 consultations. Some affected individuals were high-risk public figures who should have been subject to enhanced protections.
An Intesa Sanpaolo employee improperly accessed customer banking information, beginning a pattern of unauthorized internal consultations that affected thousands of customers. Regulators later said the bank's access model and monitoring controls were insufficient to prevent or detect the abuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Italy’s data protection authority fined telecom operator **WINDTRE** **€1,715,600** after determining that two February 2025 breaches exposed personal data belonging to more than **365,000 customers**. Attackers reportedly used **social engineering** at two WINDTRE retail locations, posing as support technicians and convincing store staff to grant access to internal systems, which enabled the exfiltration of customer information. The stolen data included contact and personal details, while **41,359 customers** also had payment-related information exposed, including **IBANs**, partially masked card numbers, expiration dates, and postal payment slip data. The regulator said the incidents were not attributable to human error alone, citing weak management of access credentials and digital certificates, along with inadequate protection and testing of internal APIs that allowed large-scale enumeration and failed to surface identifiable vulnerabilities. The authority concluded that WINDTRE violated **GDPR** requirements for integrity, confidentiality, and security, and ordered the company to strengthen credential protection, certificate handling, password management, and broader cybersecurity procedures.
Jul 21, 2026
France’s data protection regulator **CNIL** issued a collective **€42 million** fine against Iliad Group subsidiaries **Free** and **Free Mobile** for **GDPR** violations tied to an October 2024 breach that exposed personal data for more than **24 million** individuals, including sensitive financial identifiers such as **IBANs**. CNIL cited the scale and sensitivity of the compromised data, as well as the companies’ profits, in setting penalties of **€27 million** for Free and **€15 million** for Free Mobile. Regulators said the intrusion was enabled by inadequate security controls, including a **weak VPN authentication process** and insufficient monitoring to detect anomalous activity. Reporting indicates the attacker accessed Free’s network via the corporate **VPN**, then reached Free Mobile’s subscriber management tool **MOBO**, which at the time allowed searches across both Free and Free Mobile customer datasets; exfiltration reportedly began in early October 2024 after initial access in late September. CNIL also faulted the companies for **insufficient breach communications** to impacted customers and for **improper data retention** (including retaining former subscribers’ data), while noting remediation steps have been initiated and further security improvements were ordered.
Jun 29, 2026
France’s data protection authority, CNIL, imposed a €1.7 million ($2 million) fine on the software company Nexpublica France following a data breach that exposed sensitive documents of third parties through a company portal. The breach, reported in November 2022, allowed users to access documents belonging to other individuals, prompting an investigation by CNIL, which found that Nexpublica’s data security program was insufficient and failed to meet basic security standards. The regulator cited several aggravating factors in determining the fine, including Nexpublica’s lack of awareness of fundamental security principles, the number of people affected, the sensitivity of the exposed data, and the company’s financial capacity. CNIL also noted that Nexpublica was aware of the security issues prior to the breach but did not take corrective action until after the incident, constituting a violation of the General Data Protection Regulation (GDPR).
Jun 29, 2026