Italy's data protection authority fined Wind Tre S.p.A. €1,715,600 over two data breaches in which attackers extracted the personal data of more than 365,000 of the telecommunications operator's customers, according to newsletter no. 549 of the Garante per la protezione dei dati personali, published on July 16, 2026. For 41,359 of those customers, the stolen records also included details of how they paid their bills.

The decision behind the newsletter item is injunction order no. 348, adopted on May 14, 2026 and published as doc. web 10263796. It runs to considerably more detail than the newsletter's four paragraphs. The newsletter describes callers posing as technical support staff and failures in the handling of credentials and digital certificates. The full decision adds a second element that the newsletter leaves out: a set of APIs that, according to the Garante, carried no protection measures and allowed the attackers to step through customer identification numbers, sending about 2 million requests. Quotations below are PPC Land's translations from the Italian text of the newsletter. The decision itself is paraphrased.

In Short

Italy's privacy regulator fined telecoms operator Wind Tre €1.7 million after attackers posing as technical support talked staff at two of its points of sale into handing over access, then pulled personal data on more than 365,000 customers, including payment details for 41,359 of them. The case matters to any company that lets dealers, franchise stores or partners log into customer systems, because the regulator blamed how passwords and digital certificates were kept at those stores, and security tests that missed exposed APIs. Wind Tre was ordered to lock down its certificates, give stores a password manager and formalise how credentials are issued and revoked, then report back within 30 days of notification. The regulator's newsletter summary does not mention the API weakness, which the full decision links to the bulk of the extraction.

Two phone calls, two points of sale

The newsletter sets out the sequence briefly. The Garante's investigation, it says, "established that the hackers, pretending to be support technicians, convinced the operators of two points of sale to allow access to the company systems, thereby managing to exfiltrate the personal and contact data of customers." The authority, according to the newsletter, "found shortcomings in the management of access credentials and digital certificates."

For the 41,359 customers whose payment data was taken, the newsletter lists the methods involved: the bollettino postale, the paper payment slip used at Italian post offices, the IBAN, and credit cards with the number partially masked plus the expiry date. The newsletter does not say which customers or how many were affected by each kind of payment record, and neither does the decision.

Wind Tre notified the two incidents to the Garante under Article 33 of the GDPR on February 20, 2025 and February 28, 2025, according to the decision, which identifies them by the references DB008078 and DB008140. The decision places the two events at two points of sale a few days apart. It does not give the dates of the intrusions themselves.

The first incident was small. According to the decision, the attackers telephoned an employee at a point of sale, claimed that technical assistance was needed, asked for remote access to the device and, through social engineering, obtained all of the factors needed to authenticate. They then entered a company web application whose name is redacted in the published text. The decision records 66 individual queries in that incident and about 23 customers affected. It does not name the remote access software used, and it does not list which authentication factors the employee gave up.

How did the attackers get hold of what they needed once they were on the device? At the hearing before the Garante, Wind Tre said the credentials had presumably been stored in plain text on the desktop of the store computer, or recovered from the browser. The Garante, for its part, found that the digital certificates of the points of sale, and their private keys, had not been stored securely.

Two million requests

The second notification is where the scale came from. According to the decision, the incident logged as DB008140 affected 365,048 customers.

The mechanism described in the decision is enumeration. The attackers identified some APIs that had no protection measures because they were invoked after the main search function, the decision says, and then progressively increased the customer identification code, generating about 2 million requests in total. The decision does not say over what period the requests were made. It also refers to a first intrusion attempt that Wind Tre's security mechanisms blocked, after which the attackers analysed the application, without stating which of the two incidents that attempt belonged to.

That distinction matters for reading the case. The main search function was protected. The calls that followed it were not. At the hearing, according to the decision, Wind Tre said that only the main APIs had been protected. The Garante's position was that all sensitive APIs ought to have been subject to rate limiting rules, and the decision names rate limiting and CAPTCHA as the controls it had in view.

The two incident figures in the decision add up to 365,071 customers, by PPC Land's calculation. The decision gives no combined total and does not address whether any customers were caught up in both incidents. The newsletter rounds the number to "over 365,000."

What Wind Tre argued

Wind Tre contested the findings in a written defence sent by certified email on November 5, 2025, at a hearing on December 5, 2025 and in a further note dated December 11, 2025, according to the decision. The proceeding had been opened on October 6, 2025, on the basis of the company's own breach notifications. The decision mentions no complaint from a customer.

The company told the Garante that it had filed a criminal complaint with the public prosecutor's office. It listed controls that were in place before the attacks: what it described as three-factor authentication, logging, CAPTCHA, a firewall, a block on night-time access, weekly monitoring of queries, and guidance on certificates in its operating manuals. The decision does not specify what the three factors were.

On certificates, Wind Tre argued that they sat in the operating system's encrypted store, so that extracting them required a compromised device and sophisticated hacking techniques. On the APIs, it said they had been designed in line with the OWASP Top 10, a widely used list of web application security risks, and with security by design and by default principles. It attributed the events to human error that could have been avoided.

One argument went directly to how telecoms retail works in Italy. Wind Tre said it could not impose a password manager on points of sale whose staff were not its employees. The Garante rejected that argument, according to the decision.

The company also described the measures it took after the incidents. These included lower CAPTCHA thresholds, rate limiting, a web application firewall, alarms on monitoring dashboards, a mass password reset, an additional authentication factor delivered by one-time password, mystery calls to test store staff, a chat support channel, disciplinary action and staff training. The Garante gave weight to the OTP measure in particular, writing that such a system, had it been adopted earlier, would have limited what the attackers could do.

What the Garante found

The Garante's conclusion, according to the newsletter, was a "violation of the principles of integrity and confidentiality of the data and of the security obligations provided for by the GDPR." In the decision, those are Article 5(1)(f) of the GDPR, the integrity and confidentiality principle, and Article 32(1)(b), which requires the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems.

The decision ties the illicit access directly to an inadequate level of protection. Three findings carry the weight of it. First, certificates and private keys at the points of sale were not stored securely, and there were no formal procedures for managing them. Second, there was no password manager at the stores. Third, the controls on the APIs fell below the standards the Garante considers normal for the sector.

The testing finding is the one with the widest reach. Wind Tre said it ran periodic vulnerability assessments and penetration tests. According to the decision, those tests did not cover, or covered inadequately, the APIs that were exposed, and targeted checks on those interfaces would reasonably have revealed the weaknesses. The newsletter puts it more briefly: "the security checks carried out by the company had not identified vulnerabilities that would have been detectable with more thorough controls."

Three orders and a 30-day report

The Garante used its corrective powers under Article 58(2)(d) of the GDPR to impose three orders, according to the decision:

  • Certificate storage: digital certificates must be stored securely, in encrypted repositories or key management systems, with access control and protection against unauthorised export.
  • Password manager: a password manager must be introduced at points of sale.
  • Lifecycle procedures: formal procedures must govern the full lifecycle of certificates and credentials, using key management systems or hardware security modules.

Wind Tre was given 30 days from notification of the decision to report to the Garante on the measures taken, under Article 157 of the Italian Privacy Code. Failure to comply with the orders can lead to a further fine under Article 83(5)(e) of the GDPR. The newsletter summarises the same orders as requiring Wind Tre "to strengthen the protection systems for credentials and digital certificates, to introduce secure tools for password management and to improve IT security procedures to prevent similar episodes in the future."

How the fine was set

The decision sets the applicable statutory maximum at €171,560,000, based on Wind Tre's accounts at December 31, 2024, and applies Article 83(3) of the GDPR, which caps the total for linked infringements at the amount for the most serious one. The decision describes the fine of €1,715,600 as equal to 0.04 percent of turnover and 1 percent of that maximum.

The decision does not state Wind Tre's turnover. A maximum of €171,560,000 at the 4 percent level implies turnover of about €4.29 billion, by PPC Land's calculation. Spread across the 365,071 customers in the two incident counts, the fine works out at roughly €4.70 per customer, also a PPC Land calculation.

On the aggravating side, according to the decision, the Garante weighed the number of people affected and the risk that their data would be put to malicious use, under Article 83(2)(a), and a lack of diligence under Article 83(2)(d): no secure procedures for certificates, no password manager and API controls below sector standards.

On the mitigating side, it counted the measures Wind Tre took promptly and its public communication to customers, the absence of relevant previous violations, the company's cooperation and the speed of its own notification. The newsletter confirms the same three points in summary form: the authority "took into account the timely notification of the incident, the corrective measures adopted after the attack and the cooperation provided by the company during the investigation."

That communication, according to the decision, took the form of a notice in two national newspapers and on the company website, with a toll-free number, later supplemented by SMS messages to affected customers. The decision refers to a final report dated May 25, 2025 that records those notifications. It gives no dates for the newspaper notices.

Where the fine sits

The Wind Tre order arrived in a busy year for the Garante. The authority fined Intesa Sanpaolo €17.6 million in March 2026 for profiling about 2.4 million customers to select them for transfer to its digital bank Isybank. Two weeks later it fined the same bank €31.8 million after one employee accessed the records of 3,573 customers without justification between February 2022 and April 2024.

The comparison with the second Intesa case is instructive, if not straightforward. Intesa's fine covered far fewer people and was more than 18 times larger. The violations, however, were not the same. The Intesa decision found breaches of Articles 33 and 34, the notification duties, alongside the security articles. Wind Tre, by contrast, was credited for notifying quickly. The Garante's fines are tied to turnover and to a list of factors under Article 83(2), and on the Wind Tre file several of those factors pointed downward.

On the same day as the Wind Tre decision, May 14, 2026, the Garante adopted order no. 342, a formal warning to Myndoor over a Slack and Teams plug-in that inferred employee stress.

Data breaches involving exposed interfaces have drawn fines elsewhere in Europe too. Spain's AEPD fined Bankinter €240,000 after an API access-control flaw at EVO Banco exposed data on 1,275,049 people between March 23 and 27, 2024, also under Article 5(1)(f). European regulators issued €1,145,760,374 in GDPR fines in 2025, according to the EDPB's annual report published in April 2026.

The order can be challenged in court. Garante fines have not always survived: a Rome tribunal annulled the authority's €15 million OpenAI fine on jurisdictional grounds in March 2026, and an Alliance Risk analysis published in May 2026 found that nearly 40 percent of the €7.1 billion in GDPR fines announced since 2018 had been annulled or was under challenge. Neither the newsletter nor the decision says whether Wind Tre intends to appeal.

Why it matters for marketers

Telecoms customer files combine identity data, contact details and payment methods. Those are the categories the attackers took here, and the same ones that CRM, retention and telemarketing teams work with every day.

The point-of-sale finding has implications well beyond Wind Tre. Many brands give dealers, franchisees, call centres and agencies login access to customer systems. Wind Tre argued that it could not dictate tools to stores staffed by people it did not employ; the Garante did not accept that the controller's security duty stopped at the edge of its payroll. The same newsletter carries a debt-collection case built on the same idea from the other direction, with the controller fined for failing to supervise the company acting on its behalf. Regulators elsewhere have taken that line too: Poland's authority fined McDonald's Polska about €3.89 million in July 2025 over a processor's server misconfiguration, and France's CNIL fined Optimove €1 million in December 2025 for processor violations linked to Deezer user data.

The API finding speaks to how customer-facing software is tested. The decision treats rate limiting on every sensitive API, not only the primary endpoint, as the expected standard, and it holds a company responsible when its own penetration tests miss secondary calls. Nothing in the mechanism the decision describes is specific to telecoms. A protected search screen with unprotected calls behind it, and customer records numbered in sequence, was enough here for about 2 million automated requests.

The rest of newsletter 549

The Wind Tre item led a newsletter with three other stories. Each is summarised briefly below.

Debt collection: €50,000 and €30,000

The Garante fined the company that owned a debt €50,000 as data controller and the debt-collection agency working for it €30,000 as processor. The newsletter does not name either company. The underlying decisions of May 28, 2026 name them as Europa Factor S.p.A. (order no. 386) and Spinbridge S.p.A. (order no. 387).

The case started with a report from a debtor whose debt was being pursued through a mobile phone number registered in the debtor's name but no longer in the debtor's possession. He asked how the companies had obtained it. According to the newsletter, the controller "had not adequately supervised the activities carried out by the processor company and the instructions given to it," while the processor "had not provided the controller with an updated picture of the information collected during the assignment and had not informed it that the debtor had asked to know the origin of the telephone number contacted for the purpose of debt recovery." The decisions cite Articles 5(1)(a), 5(1)(d), 5(2) and 24 of the GDPR for Europa Factor and Article 28(3)(a), (e) and (h) for Spinbridge, which was given six months to adopt measures.

Enel Energia and call recordings

In a decision also dated May 28, 2026 (order no. 391), the Garante found that Enel Energia S.p.A. had wrongly refused a customer's request for access to a recorded call with its customer service line. Enel had argued that the operator on the call gave details, such as a name and staff number, that could identify them. According to the newsletter, the Garante said such access requests "can also be satisfied by delivering the transcript of the conversation, provided that the elements that allow any other persons involved to be identified are obscured." It pointed to masking the operator's data or disguising the voice as possible measures, and concluded that Enel could have met the request by first obscuring the operator's identifying details, a step that, given the professional context of the call and its subject, a gas supply contract, would not have harmed the operator's right to confidentiality. The decision cites Articles 12 and 15 of the GDPR and gives Enel 30 days to comply. Neither the newsletter nor the published decision mentions a fine, although two items in the operative part of the published text are redacted.

Access requests under Article 15 have been contested at every level: in April 2026 an Advocate General at the EU Court of Justice said data protection authorities must themselves answer such requests, and Belgium's authority fined a telecom company €100,000 in August 2024 for taking more than 14 months to answer one.

EDPB guidelines on anonymisation, web scraping and blockchain

At its July plenary, the European Data Protection Board adopted guidelines on anonymisation and on web scraping in the context of generative AI, and the final version of its guidelines on blockchain, according to the newsletter. PPC Land covered each at the time: the anonymisation guidelines replace the 2014 Article 29 Working Party test, the web scraping guidelines treat consent as most probably unworkable for scraping at scale, and the final blockchain guidelines followed the version consulted on in 2025.

The newsletter quotes EDPB chair Anu Talus, in Italian, as saying the anonymisation guidelines "represent an important step forward in clarifying the notion of anonymous data, defining clear standards that favour the use of data, while at the same time safeguarding the fundamental rights of people." The framework, according to the newsletter, offers two approaches, a contextual one that accounts for the different capabilities of those who might identify a person and a simplified, more cautious one, plus three technical criteria that must all be met: no isolation of a record, no linkage and no inference. Both the anonymisation and web scraping guidelines were open for public comment until October 30, 2026.

The newsletter closes with a list of recent Garante actions: a press release of July 9, 2026 on a fine against Character.AI that also raised concerns about the protection of minors and age verification, a press release of June 26, 2026 on common G7 privacy principles for protecting children online and for rights-respecting AI, and the presentation of the Garante's annual report on June 25, 2026.

Timeline

Summary

Who: Italy's data protection authority, the Garante per la protezione dei dati personali, and Wind Tre S.p.A., a telecommunications operator based in Milan. The attacks hit two of its points of sale. The same newsletter covers Europa Factor S.p.A., Spinbridge S.p.A., Enel Energia S.p.A. and the European Data Protection Board.

What: The Garante fined Wind Tre €1,715,600 for breaching Articles 5(1)(f) and 32(1)(b) of the GDPR after two intrusions. Callers posing as technical support obtained access at two points of sale, and unprotected APIs allowed about 2 million requests that stepped through customer identification numbers. Data on more than 365,000 customers was taken, including payment details for 41,359. The authority ordered secure certificate storage, a password manager at points of sale and formal credential lifecycle procedures, with a report due within 30 days of notification.

When: The breaches were notified on February 20 and 28, 2025. Proceedings opened on October 6, 2025, the decision was adopted on May 14, 2026, and the Garante announced it in newsletter no. 549 on July 16, 2026.

Where: Italy. Wind Tre is based in Milan, and the Garante sits in Rome.

Why: The Garante held that an inadequate level of protection allowed the attacks: certificates and private keys were not stored securely, stores had no password manager, and penetration tests missed exposed APIs that lacked rate limiting. The case extends a controller's security duty to points of sale staffed by people it does not employ, and treats protection of secondary API calls as part of the expected standard. The fine was reduced by prompt notification, cooperation and corrective measures, and it equals 1 percent of the €171,560,000 maximum.