Italian DPA fines Wind Tre EUR 1,7 million for data security failures affecting over 365 000 customers

Wind Tre suffered two significant personal data breaches after social engineering attacks successfully manipulated retail outlet employees, ultimately compromising the data of over 365,000 customers including sensitive payment details. The Italian DPA found that the breaches were compounded by inadequate management of digital certificates, private keys, and access credentials, as well as weak API security controls. This case illustrates that technical vulnerabilities and human susceptibility are equally dangerous when not addressed in tandem. Organisations that fail to train frontline staff against social engineering while simultaneously leaving credential and certificate management ungoverned create multiple, overlapping attack surfaces. The resulting €1.7 million fine underscores the direct regulatory and financial consequences of neglecting both human and technical security controls.