[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwFzAYoSiEHCXxGY0mFi-kv-SrMRydaK3jsCaSkpL4Q4":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"efb66f95-5da2-4cf0-a6f0-52ad8cbbddce","Italian DPA fines Wind Tre EUR 1,7 million for data security failures affecting over 365 000 customers","italian-dpa-fines-wind-tre-eur-1-7-million-for-data-security-failures-affecting-6298d9","Italian DPA fines Wind Tre EUR 1,7 million for data security failures affecting over 365 000 customers ikerinar Tue, 10\u002F11\u002F2026 - 12:25","The Italian Data Protection Authority (DPA) has fined Wind Tre S.p.A. EUR 1.7 million due to significant data security failures that led to two personal data breaches. These breaches, resulting from social engineering attacks on retail outlet employees, compromised the data of over 365,000 customers, with some including sensitive payment details. The DPA cited inadequate management of digital certificates, private keys, access credentials, and weaknesses in API security controls as key findings.","Italian DPA fines Wind Tre EUR 1.7M for data security failures affecting 365K+ customers.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-wind-tre-eur-17-million-for-data-security-failures-affecting-over-365-000_en",null,"2026-11-10T11:25:01+00:00","2026-11-10T12:00:25.264474+00:00",8,[17],{"name":18,"type":19},"Wind Tre","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":12,"name":22,"slug":23},"Policy","policy",[25,30,35,37],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":20,"icon":12,"name":22,"slug":23},{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":45,"vendors":133},[46,75,104],{"slug":47,"name":48,"problem":49,"products":50},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":76,"name":77,"problem":78,"products":79},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":105,"name":106,"problem":107,"products":108},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":146},"wind-tre-fined-17m-after-social-engineering-breaches-expose-365000-customers","Wind Tre Fined €1.7M After Social Engineering Breaches Expose 365,000 Customers","Wind Tre suffered two significant personal data breaches after social engineering attacks successfully manipulated retail outlet employees, ultimately compromising the data of over 365,000 customers including sensitive payment details. The Italian DPA found that the breaches were compounded by inadequate management of digital certificates, private keys, and access credentials, as well as weak API security controls. This case illustrates that technical vulnerabilities and human susceptibility are equally dangerous when not addressed in tandem. Organisations that fail to train frontline staff against social engineering while simultaneously leaving credential and certificate management ungoverned create multiple, overlapping attack surfaces. The resulting €1.7 million fine underscores the direct regulatory and financial consequences of neglecting both human and technical security controls.",[139,140,141,142,143,144,145],"CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":147,"NIS2 Article 21(2)(b)":148,"MITRE ATT&CK T1566: Phishing":149,"CIS Control 17: Incident Response Management":150,"CIS Control 14: Security Awareness and Skills Training":151,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":152,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":153},"Article 32 requires organisations to implement appropriate technical and organisational measures to ensure data security; Wind Tre's failures in credential management, API controls, and staff training directly violated this obligation and triggered the €1.7M fine.","NIS2 explicitly requires incident handling measures and security controls around access and authentication; the inadequate API security and credential management practices found by the DPA represent direct gaps against this requirement.","The social engineering attacks on retail employees are consistent with this technique, where adversaries manipulate individuals to gain access or credentials; defences against T1566 include training and multi-factor authentication.","The scale of the breach — over 365,000 customers affected — suggests delayed or insufficient incident detection and response; a mature IR capability would have contained the breach sooner and limited customer impact.","Retail employees were manipulated via social engineering; a structured, role-specific security awareness programme targeting frontline staff would have reduced susceptibility to these attacks.","Weak API security controls and poor certificate management represent unmitigated technical vulnerabilities that a formal vulnerability management process would have identified and remediated before exploitation.","The DPA found inadequate management of access credentials and private keys; enforcing strong identity and access controls would have limited attackers' ability to exploit compromised credentials."]