Editorial explainer · Italian DPA (Garante) decisionmedium
Wind Tre, €1.7M from the Italian DPA: when the flaw isn't an exploit but a clerk talked into it
Italy's data protection authority (the Garante) fined Wind Tre €1,715,600 for serious shortcomings in system security. According to the authority, two unauthorized accesses led to the exfiltration of personal data of over 365,000 customers; for 41,359 of them, payment-method data was also touched. The interesting part: the way in was not an exploit but an attacker posing as technical support who talked staff at two retail stores into granting access.
An explainer, not the attack of the day
This piece doesn't cover a new technical intrusion: it covers a decision and what it teaches. On 16 July 2026 Italy's data protection authority (the Garante) disclosed a fine against Wind Tre. The figure — €1,715,600 — is news on its own, but the part worth reading is why it was imposed, because it dismantles a convenient idea: that data breaches are mostly a firewall problem.
What happened, per the authority
The proceeding stems from two data breaches the company itself notified in February 2025. According to the Garante's reconstruction, the attackers posed as technical support staff and convinced clerks at two retail stores to allow access to company systems. From there they extracted customers' personal and contact data.
The scope: personal data of over 365,000 customers. For 41,359 of them, the exfiltration also involved payment-method information — reportedly postal money orders, IBANs, card numbers (partially masked) and expiry dates. The Garante found serious shortcomings in system security at the root: not just the successful deception, but the conditions that made it possible and productive.
Why it's a textbook case
Because it flips the cliché. At the center there is no CVE or sophisticated malware: there is social engineering applied to the most human point in the chain — a store clerk, under pressure, receiving an apparently legitimate request from a "technical colleague." It's the same pattern that, in other guises, opens ransomware intrusions: access isn't found, it is obtained by asking well.
The fine, though, does not punish the deceived clerk. It punishes the organization for not standing up the defenses that would have contained the damage: controls on system access from stores, procedures to verify the identity of anyone requesting support, limits on how much data a single access can touch. That's the difference between blaming the person and designing a system that holds even when a person errs.
What a company takes away
Three things, all cheap next to €1.7M. First, verify who's asking: a call-back or independent-channel confirmation before granting "support" access cuts most of these attacks. Second, access minimization: if a store terminal doesn't need to bulk-export 365,000 customers' data, it must not be able to — the damage of a single deception is measured by how far that deception can reach. Third, notification: Wind Tre notified the breaches, as the GDPR requires within 72 hours of discovery; that is the due act, and having done it is part of how you handle it, not what you got wrong.
For the legal detail — the basis of the fine, the articles cited, the prescriptions — the reference is the Garante's decision, recalled in the newsletter of 16 July 2026. The point here stays one: personal data security rests on verifiable procedures as much as on technology, and an organization answers for both.
