Loading story…
Italy’s Data Protection Authority fined IQVIA Solutions Italy Srl €7 million for unlawfully processing health information concerning approximately one million patients of 800 general practitioners. The authority found that data described as anonymous allowed patients to be tracked and potentially re-identified, while the database contained explicit identifying information for more than 3,300 patients. The investigation followed inspections in April 2025 and included proceedings concerning a personal data breach reported by IQVIA.
The authority found that IQVIA lacked an appropriate legal basis, adequate patient information, defined retention periods, a data protection impact assessment, and adequate security measures. IQVIA must bring its processing into compliance within 120 days if it wishes to continue; alternatively, physicians must independently anonymize the data under the authority’s safeguards. The ruling underscores the need for healthcare data processors to validate anonymization against tracking and re-identification risks rather than rely on claims that a dataset is anonymous.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
The authority adopted provision no. 710, imposing a €7 million fine after finding that supposedly anonymous patient data could enable re-identification and that the database contained explicit identifiers for more than 3,300 patients. It found deficiencies in legal basis, patient information, retention, impact assessment and security, and ordered compliance within 120 days if processing continued, or independent anonymization by physicians under specified safeguards.
Inspections carried out in April 2025 were followed by an investigation into IQVIA's processing of patient health information.
Physicians stopped transmitting data to IQVIA starting in 2023. The Italian Data Protection Authority later considered this cessation when determining its fine.
IQVIA notified a personal data breach to the Italian Data Protection Authority. Proceedings concerning that breach were included in the authority's investigation.
IQVIA Solutions Italy Srl created a database containing health information concerning one million patients of 800 general practitioners. It used the database for studies commissioned by pharmaceutical companies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Italy’s Data Protection Authority fined **Intesa Sanpaolo** €31.8 million after finding that the bank failed to adequately protect customer banking data from unauthorized internal access. The investigation, opened after a July 2024 breach disclosure, found that an employee improperly accessed the records of **3,573 customers** and carried out more than **6,600 consultations** between February 2022 and April 2024. Regulators said the bank’s technical and organizational safeguards were inadequate and that its operating model granted excessively broad access across the customer base. Authorities said the activity went undetected because of weaknesses in the bank’s monitoring and prevention systems, and they noted that some affected customers were high-profile public figures who should have received enhanced protection. The regulator also criticized Intesa Sanpaolo for incomplete and delayed notifications to affected customers after the breach, while noting that remediation steps later taken by the bank to strengthen internal controls and data security safeguards were considered in setting the penalty.
Jun 29, 2026
France’s data-protection authority, CNIL, fined Hôpital privé de la Loire (HPL) **€500,000** over a 2025 breach in which an attacker used a compromised doctor’s account to access its electronic patient-record system. The incident exposed sensitive data for 524,867 patients and 202,246 trusted third parties—more than **727,000 people** in total. A person using the alias “Marak” claimed responsibility; three suspects were arrested in late June in connection with attacks on automated data-processing systems. CNIL found that HPL allowed remote access without a VPN or multifactor authentication, assigned overly broad permissions that enabled one compromised account to reach all patient records, and lacked monitoring capable of promptly detecting prolonged exploration and exfiltration. The authority also found that HPL failed to directly notify affected third parties, violating GDPR Articles 32 and 34. HPL has been ordered to correct the identified deficiencies within deadlines ranging from three to 15 months.
Sep 4, 2026
Italy’s data protection authority fined telecom operator **WINDTRE** **€1,715,600** after determining that two February 2025 breaches exposed personal data belonging to more than **365,000 customers**. Attackers reportedly used **social engineering** at two WINDTRE retail locations, posing as support technicians and convincing store staff to grant access to internal systems, which enabled the exfiltration of customer information. The stolen data included contact and personal details, while **41,359 customers** also had payment-related information exposed, including **IBANs**, partially masked card numbers, expiration dates, and postal payment slip data. The regulator said the incidents were not attributable to human error alone, citing weak management of access credentials and digital certificates, along with inadequate protection and testing of internal APIs that allowed large-scale enumeration and failed to surface identifiable vulnerabilities. The authority concluded that WINDTRE violated **GDPR** requirements for integrity, confidentiality, and security, and ordered the company to strengthen credential protection, certificate handling, password management, and broader cybersecurity procedures.
Jul 21, 2026