Italy's Data Protection Authority (Garante) has fined Wind Tre S.p.A. €1,715,600 for serious security failures in its corporate systems that enabled two unauthorized accesses and the exfiltration of personal data belonging to over 365,000 customers. Measure No. 348 of May 14, 2026, made public on July 16, 2026, concerns two data breaches that occurred in February 2025 and establishes a principle the enterprise sector can no longer ignore: the security perimeter extends physically to retail outlets.
- The administrative fine amounts to €1,715,600, equal to 0.04% of company revenue, for violations of Articles 5 and 32 GDPR.
- The attack was carried out via phone-based social engineering: fake support technicians convinced operators at two retail stores to grant access to corporate systems.
- Data of over 365,000 customers was exposed; for 41,359 of them the exfiltration also included payment method details, such as postal payment slips, IBANs, partially masked credit card numbers, and expiration dates.
- The Garante found deficiencies in the management of access credentials and digital certificates, and ordered Wind Tre to strengthen protection of both elements.
The Attack Mechanism: Social Engineering Against Weak Procedures
The entry vector was not technical. According to the Garante's reconstruction, "the hackers, posing as support technicians, convinced operators at two retail outlets to grant access to corporate systems." The official wording rules out the use of software exploits or compromise of remote infrastructure: authentication was obtained by manipulating people in the flesh, over the phone, exploiting a lack of identity verification on an independent channel.
The dossier does not specify the duration of the unauthorized access nor the exact operational timeline of the two events. There is no doubt, however, about the consequences: the massive exfiltration occurred after this first human checkpoint was bypassed. The source does not reveal the attackers' identity nor the destination of the stolen data.
"You don't need to breach firewalls if you can convince a person" — Enrico Capirone, President iSimply srl, DPO
What the Garante Found: Credentials, Certificates, and Insufficient Checks
The May 14, 2026 measure documents three orders of problems. First: "deficiencies in the management of access credentials and digital certificates." Second: the security checks performed by Wind Tre "had not identified vulnerabilities that would have been detectable with more thorough controls." Third: the ascertained violations fall under Articles 5(1)(f) (integrity and confidentiality) and 32(1)(b) (security of processing) of the GDPR.
Article 32 GDPR requires the controller to implement "a level of security appropriate to the risk," including measures such as pseudonymization, access control, and system protection. The Garante interpreted this obligation extensively: the retail outlet is an extension of the corporate information system, not a periphery excluded from compliance. Credentials and digital certificates managed in those contexts fall within the same regulatory perimeter as central data centers.
Why It Matters
The measure establishes that the GDPR controller is accountable for weaknesses in retail outlets, resellers, and distribution channels. This principle, expressed in industry reading as "the controller is also responsible for the weaknesses of its own distribution channels," has concrete consequences for any organization with a physical sales or support network: anti-social-engineering training, multi-factor authentication, and audits extended to the supply chain become obligations deriving directly from Article 32, not optional recommendations.
The dossier does not specify the corrective measures adopted by Wind Tre after the attack, although these were mentioned among the mitigating factors for the fine. It does not emerge whether the measure prescribes implementation deadlines or verification methodologies for the orders issued. The Garante expressly requested: strengthening the protection of credentials and digital certificates; introduction of secure tools for password management; improvement of cybersecurity procedures.
The fine of €1,715,600, while representing 0.04% of revenue, sits in a significant bracket for the Italian telco sector. Its severity is mitigated by the recognized attenuating circumstances: timely incident notification, post-event corrective measures, and cooperation during the investigation. This sanctioning profile suggests that failure to meet any one of these three elements would have resulted in a higher penalty.
Retail Data as a Security Perimeter
The Wind Tre case exposes a common discontinuity in enterprise security design: the concentration of investments on central infrastructure while leaving peripheral nodes with proportionally weaker controls. Measure No. 348/2026 rules that this asymmetry is not justifiable from a risk perspective: the compromised retail outlet opened access to a volume of data comparable to that of a hub system breach.
The brief does not document the technical detail of the "vulnerabilities" not identified by internal security checks, nor the specific authentication architectures in use at the retail outlets involved. The Garante has not disclosed whether the deceived operators were subject to internal disciplinary proceedings or whether Wind Tre modified its inbound call verification protocols.
For the 41,359 customers with exposed payment data, the concrete risk depends on the use the attackers made of the information. The dossier does not specify whether the data was published, sold, or used for subsequent fraudulent activity. The credit card number was partially masked: this circumstance reduces the immediate fungibility of the data, but does not eliminate the risk of correlation with other information sources.
Sector Impact and Reading of the Measure
The Italian telecommunications sector registers a confirmation: even national-scale operators remain vulnerable to low-tech attack techniques based on psychological manipulation rather than technical sophistication. The value of the measure lies in its extended deterrent function: every controller with a distribution network must now presume that its attack perimeter includes the totality of physical points of contact with the public.
The Garante explicitly linked the severity of the fine to the scale of potential damage: over 365,000 exposed profiles, with a substantial minority (approximately 11.3%) including sensitive financial data. This quantification provides a benchmark for risk assessments by companies with comparable customer bases.
Information is based on the cited measure and current as of the time of publication.
Sources
- https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10272004
- https://www.isimply.it/news/data-breach-wind-tre-sanzione-garante-falsi-tecnici/
- https://www.imgpress.it/tecnologia/data-breach-il-garante-privacy-sanziona-wind-tre-per-17-milioni-di-euro-gravi-carenze-nella-sicurezza-dei-dati-coinvolti-oltre-365mila-clienti/
- https://www.mlex.com/mlex/articles/2304269/telecommunications-company-wind-tre-faces-italian-gdpr-fine
- https://www.mlex.com/mlex/data-privacy-security
Information is based on the cited source and current as of the time of publication.