Background information

• Date of final decision: 14/05/2026
• National case
• Controller: Wind Tre S.p.A.
• Legal References: Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing)
• Decision: Administrative fine, Compliance order
• Key words: Personal data breaches, Basic principles, Cybersecurity

Summary of the Decision

Origin of the case

The Italian Data Protection Authority (DPA) launched an investigation into Wind Tre S.p.A. following two personal data breaches notified by the company in February 2025.

The breaches involved unauthorised access to the company's systems at two different retail outlets. The attackers, posing as technical support staff, used social engineering techniques to persuade employees to grant remote access to their devices.

The attackers subsequently gained access to customers' personal data, including identification and contact details. Overall, the breaches affected more than 365 000 customers. For 41 359 individuals, the compromised information also included payment method details, such as IBANs, postal payment slips and partially masked credit card numbers with expiry dates.

Key Findings

The Italian DPA found serious shortcomings in the technical and organisational measures implemented by Wind Tre to ensure the security of personal data. In particular, the investigation identified inadequate management and protection of digital certificates, private keys and access credentials used within the company's sales network.

The DPA also found weaknesses in the security controls applied to certain application programming interfaces (APIs), which had allowed the attackers to carry out a large number of requests and extract customers' personal data.

Furthermore, the security assessments carried out by the company had failed to identify vulnerabilities that could have been detected through more thorough checks.

They concluded that Wind Tre had failed to implement appropriate security measures to protect personal data against unauthorised access, in breach of the principle of integrity and confidentiality under Article 5(1)(f) and the security requirements laid down in Article 32(1)(b) GDPR.

Decision

The Italian DPA imposed an administrative fine of EUR 1 715 600 on Wind Tre S.p.A.

The DPA also ordered the company to strengthen its technical and organisational security measures. In particular, Wind Tre was required to:

• Ensure that digital certificates are stored using secure solutions, such as encrypted repositories or dedicated key management systems, with appropriate access controls and safeguards against unauthorised export.
• Implement password management systems for retail outlets to ensure secure storage, password complexity and periodic password rotation.
• Improve procedures for managing the lifecycle of digital certificates and credentials, including their issuance, distribution, revocation and renewal, through formalised processes and dedicated security systems.

Wind Tre was also required to inform the Italian DPA, within 30 days of notification of the decision, of the measures taken to comply with the order.

In determining the amount of the fine, the Italian DPA took into account the number of individuals affected and the security shortcomings identified, as well as the company's prompt notification of the breaches, the corrective measures adopted following the incidents and its cooperation during the investigation.

For further information:

• Italian DPA Decision (IT)