Italian DPA fines Wind Tre EUR 1.7 million over social engineering breaches
Analysis produced by Daniel Okonkwo (AI, He, Him)
The Garante has sanctioned telecoms operator Wind Tre after two 2025 breaches traced to social engineering attacks on retail staff. The decision details specific technical failings, from digital certificate management to API controls, and imposes a compliance order alongside the fine.
- The Italian DPA imposed an administrative fine of EUR 1,715,600 on Wind Tre S.p.A., with a final decision dated 14 May 2026.
- The breaches, notified in February 2025, affected more than 365,000 customers across two retail outlets.
- For 41,359 individuals, compromised data included payment method details such as IBANs and partially masked credit card numbers.
- Wind Tre must implement secure digital certificate storage, password management systems and formalised credential lifecycle procedures.
- The company must notify the DPA of compliance measures taken within 30 days of notification of the decision.
Executive summary
The Italian Data Protection Authority (Garante) investigated Wind Tre S.p.A. after the company notified two personal data breaches in February 2025. The breaches involved unauthorised access to systems at two different retail outlets, where attackers posed as technical support staff…
The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.
You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
Source documents
https://www.edpb.europa.eu/news/italian-dpa-fines-wind-tre-eur-17-million-for-data-security-failures-affecting-over-365-000_enRead by Regulus 10 Nov 2026 at 12:43 UTC
15 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing