Loading story…
Italy’s data protection authority fined telecom operator WINDTRE €1,715,600 after determining that two February 2025 breaches exposed personal data belonging to more than 365,000 customers. Attackers reportedly used social engineering at two WINDTRE retail locations, posing as support technicians and convincing store staff to grant access to internal systems, which enabled the exfiltration of customer information. The stolen data included contact and personal details, while 41,359 customers also had payment-related information exposed, including IBANs, partially masked card numbers, expiration dates, and postal payment slip data.
The regulator said the incidents were not attributable to human error alone, citing weak management of access credentials and digital certificates, along with inadequate protection and testing of internal APIs that allowed large-scale enumeration and failed to surface identifiable vulnerabilities. The authority concluded that WINDTRE violated GDPR requirements for integrity, confidentiality, and security, and ordered the company to strengthen credential protection, certificate handling, password management, and broader cybersecurity procedures.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
WINDTRE notified the two data breaches to Italy’s data protection authority in February 2025. The notifications concerned the intrusions later tied to weaknesses in credential, certificate, and API security controls.
Italy’s data protection authority fined WINDTRE €1,715,600 after concluding that the company’s security shortcomings contributed to the February 2025 breaches. The regulator found GDPR violations and ordered improvements to credential protection, certificate handling, password management, and cybersecurity procedures.
In February 2025, attackers posing as support technicians convinced operators at two WINDTRE retail locations to grant access to internal systems, enabling two unauthorized intrusions. The incidents exposed personal and contact data of more than 365,000 customers, and payment-related data for 41,359 people was exfiltrated.
Italy’s data protection authority said the sanction against WINDTRE was announced in newsletter no. 549 published on July 16, 2026. The notice described serious security deficiencies linked to the two breaches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Italy’s Data Protection Authority fined **Intesa Sanpaolo** €31.8 million after finding that the bank failed to adequately protect customer banking data from unauthorized internal access. The investigation, opened after a July 2024 breach disclosure, found that an employee improperly accessed the records of **3,573 customers** and carried out more than **6,600 consultations** between February 2022 and April 2024. Regulators said the bank’s technical and organizational safeguards were inadequate and that its operating model granted excessively broad access across the customer base. Authorities said the activity went undetected because of weaknesses in the bank’s monitoring and prevention systems, and they noted that some affected customers were high-profile public figures who should have received enhanced protection. The regulator also criticized Intesa Sanpaolo for incomplete and delayed notifications to affected customers after the breach, while noting that remediation steps later taken by the bank to strengthen internal controls and data security safeguards were considered in setting the penalty.
Jun 29, 2026
France’s data protection regulator **CNIL** issued a collective **€42 million** fine against Iliad Group subsidiaries **Free** and **Free Mobile** for **GDPR** violations tied to an October 2024 breach that exposed personal data for more than **24 million** individuals, including sensitive financial identifiers such as **IBANs**. CNIL cited the scale and sensitivity of the compromised data, as well as the companies’ profits, in setting penalties of **€27 million** for Free and **€15 million** for Free Mobile. Regulators said the intrusion was enabled by inadequate security controls, including a **weak VPN authentication process** and insufficient monitoring to detect anomalous activity. Reporting indicates the attacker accessed Free’s network via the corporate **VPN**, then reached Free Mobile’s subscriber management tool **MOBO**, which at the time allowed searches across both Free and Free Mobile customer datasets; exfiltration reportedly began in early October 2024 after initial access in late September. CNIL also faulted the companies for **insufficient breach communications** to impacted customers and for **improper data retention** (including retaining former subscribers’ data), while noting remediation steps have been initiated and further security improvements were ordered.
Jun 29, 2026
A UK local authority disclosed personal data during its complaints-handling process after forwarding complaints to a councillor with **all complainants’ identifying details** included, despite some complainants opting to withhold their names. The information reportedly exposed included sensitive contact details (e.g., home addresses, email addresses, phone numbers) that would not normally be shared with the subject of a complaint, raising a **data protection breach** and governance concerns around how complaint records are processed and redacted. Separately, the UK **Information Commissioner’s Office (ICO)** won a court battle in its long-running attempt to uphold a **£500,000 fine** against **DSG Retail** (owner of *Currys PC World* and *Dixons Travel*) tied to a major 2017 breach in which malware was installed on **5,390 point-of-sale tills** and remained undetected for **nine months**. The incident involved theft of **5.6 million payment card numbers and expiry dates** (without cardholder names) and personal data relating to roughly **14 million individuals**; a central legal dispute is whether the payment card data alone constitutes **personal data** under the applicable pre-GDPR regime. A third item argues for using **tax incentives** (modeled on green-energy policy) to drive “security by design” and improve cybersecurity outcomes, but it is a policy opinion piece rather than reporting on a specific incident or enforcement action.
Jun 29, 2026