Severity: Info Other, enforcement EU
Italian DPA fines Wind Tre EUR 1.7 million for data security failures affecting over 365,000 customers
Original title: Italian DPA fines Wind Tre EUR 1,7 million for data security failures affecting over 365 000 customers
- Published
- Source: edpb.europa.eu
- Effective
- Not stated
- Deadline
- Not stated
- Framework: GDPR
- Regulation (EU) 2016/679 (as corrected 2018) source
- in 13 days
- Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source
Why it matters
The Italian DPA fined Wind Tre EUR 1,715,600 for serious shortcomings in technical and organisational measures used to protect personal data following two breaches affecting over 365,000 customers. The investigation found inadequate management of digital certificates, private keys and access credentials, as well as weaknesses in API security controls that allowed attackers to extract customer data. Wind Tre must now implement secure storage for digital certificates, password management systems, and improved credential lifecycle management procedures, demonstrating that organisations must establish robust security measures to comply with GDPR Article 32 requirements and protect against social engineering attacks.
What changed
- Italian DPA found Wind Tre failed to implement appropriate security measures under GDPR Article 32(1)(b), specifically inadequate management and protection of digital certificates, private keys and access credentials within the company's sales network, violating the principle of integrity and confidentiality under Article 5(1)(f)
- Weaknesses in API security controls allowed attackers to conduct large-scale data extraction; the company's security assessments had failed to identify these vulnerabilities that should have been detected through more thorough checks
- Wind Tre was ordered to ensure digital certificates are stored using secure solutions such as encrypted repositories or dedicated key management systems with appropriate access controls and safeguards against unauthorised export
- Wind Tre was required to implement password management systems for retail outlets to ensure secure storage, password complexity and periodic password rotation
- Wind Tre must improve procedures for managing the lifecycle of digital certificates and credentials through formalised processes and dedicated security systems
Who is affected
Telecommunications companies and other controllers processing large volumes of personal data through retail networks and APIs in the EU, particularly those handling payment method details and identification information
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.