Italian DPA fines Wind Tre EUR 1.7 million over social engineering breaches
The Garante has sanctioned telecoms operator Wind Tre after two 2025 breaches traced to social engineering attacks on retail staff. The decision details specific technical failings, from digital certificate management to API controls, and imposes a compliance order alongside the fine.
- The Italian DPA imposed an administrative fine of EUR 1,715,600 on Wind Tre S.p.A., with a final decision dated 14 May 2026.
- The breaches, notified in February 2025, affected more than 365,000 customers across two retail outlets.
- For 41,359 individuals, compromised data included payment method details such as IBANs and partially masked credit card numbers.
- Wind Tre must implement secure digital certificate storage, password management systems and formalised credential lifecycle procedures.
- The company must notify the DPA of compliance measures taken within 30 days of notification of the decision.