Italy fines WINDTRE €1.7 million over security flaws behind two data breaches

Italy’s data protection authority, the Garante per la Protezione dei Dati Personali, fined WINDTRE €1.7 million over “serious data security shortcomings” that let hackers breach its systems twice and exfiltrate personal data belonging to more than 365,000 customers.

The regulator opened its investigation after WINDTRE, one of Italy’s major telecom operators, reported two separate data breaches in February 2025.

The attackers relied on old-school social engineering instead of exploiting software vulnerabilities. Posing as support technicians, they convinced staff at two WINDTRE stores to grant them access to company systems. That access let them pull customer names and contact details out of the company’s systems.

Payment data exposed for thousands

For 41,359 of the affected customers, the stolen data went beyond names and contact information. It included payment details: postal payment slips, IBAN numbers, partially masked credit card numbers, and card expiry dates.

The regulator found deficiencies in how the company managed login credentials and digital certificates. Its investigation also found that WINDTRE’s own security audits had missed vulnerabilities that more thorough checks would have caught. According to the authority, these vulnerabilities allowed hackers to access the company’s systems and steal personal data.

The technical flaws the regulator couldn’t ignore

WindTre argued it already had solid security in place: three-factor authentication, CAPTCHA, firewalls, night-time access blocks, and weekly monitoring of store lookups. The company said the incidents came down to human error, unrelated to system vulnerabilities. It also said it couldn’t force independently run stores or non-employee staff to use a password manager.

The regulator rejected that defense and pointed to two technical failures.

The first was certificate handling. WindTre’s digital certificates and private keys weren’t stored in encrypted vaults or dedicated key-management systems, leaving them exposed if a device were compromised.

The second was API protection. The secondary, internal APIs that let the enumeration attack run at scale, roughly 2 million requests, weren’t covered by the company’s own vulnerability testing; only the main APIs were. The regulator said rate-limiting and CAPTCHA on those endpoints, standard under the OWASP API Security Top 10 framework, would likely have caught it.

The regulator ruled that WINDTRE broke GDPR rules on data integrity, confidentiality, and security. As part of its decision, the authority ordered the company to:

• Strengthen how it protects login credentials and digital certificates
• Introduce secure tools for password management
• Improve its cybersecurity procedures to prevent similar incidents

In setting the penalty amount, the regulator weighed four things: how quickly WINDTRE reported the breaches, the steps the company took to fix problems after the attack, its cooperation during the investigation, and the fact that WINDTRE had no prior privacy violations on record.