Published on 3 August 2026
A phone call. A supposed support technician. An employee who unsuspectingly grants remote access to their computer. That was all the attackers needed to siphon off the data of more than 365,000 customers at the Italian telecommunications provider Wind Tre – including, for over 41,000 individuals, sensitive payment information such as IBANs and credit card details. The Italian data protection authority responded with a fine of 1,715,600 euros. The case is part of the top 5 GDPR fines in July 2026, which dr-datenschutz.de summarised on 3 August 2026 – and it strikingly demonstrates how technical security can fail at a single human weak point.
The attack on Wind Tre did not begin with a sophisticated technical exploit, but with a phone call. The perpetrators posed as IT support technicians and convinced employees at two sales outlets to grant them remote access to their devices – a classic social engineering attack, i.e. the targeted manipulation of people in order to circumvent technical protection mechanisms.
The actual damage, however, arose from several coinciding failures. On the employees' devices, digital certificates and login credentials were stored, in some cases in plain text on the desktop – i.e. unencrypted and visible to anyone who gained access to the computer. That is exactly what the attackers did: they captured these credentials.
After an initial, still-repelled attempt, the perpetrators identified unprotected secondary APIs in the company's web application. An API (Application Programming Interface) is a programming interface through which software systems exchange data in an automated way. These interfaces were protected neither by rate limiting (a restriction on the number of requests per unit of time) nor by CAPTCHAs (tests to distinguish humans from machines).
Once the attackers were inside the system, they carried out what is known as an enumeration attack. This means: they systematically queried consecutive customer IDs, incrementing the customer number (customerId) step by step, and in doing so unleashed around 2 million automated requests on the interface. Because no rate limiting was in place, no one could stop this flood of requests – and the API dutifully returned the corresponding customer data for each ID.
The result: 365,048 customer records were exfiltrated, including payment information such as IBANs and partially masked credit card data for over 41,000 customers. The Italian data protection authority (Garante per la protezione dei dati personali) identified serious deficiencies: in the management of credentials, in the digital certificates, and in the security testing of the APIs.
The authority stated clearly in its decision:
„These certificates, as well as the associated private keys, should have been stored using secure solutions … The absence of an integrated approach providing for regular vulnerability assessments and targeted penetration tests of the APIs thus contributed to the persistence of vulnerabilities that were subsequently exploited in the attack.“ – Garante per la protezione dei dati personali
These recommendations – rate limiting, CAPTCHAs, protection against enumeration – correspond to the OWASP API Security Top 10, a widely recognised list of the most important API security risks. Anyone who ignores them falls short of the "state of the art" that the GDPR explicitly requires.
On a positive note: Wind Tre complied with the 72-hour notification obligation under Art. 33 GDPR – that is, the obligation to report a data breach to the supervisory authority within three days. This had a mitigating effect on the penalty.
Those directly affected are the more than 365,000 Wind Tre customers whose data was leaked. But for the readers of shieldgaps.com, the crucial insight is a different one: this attack path works at almost any company that operates APIs and employs staff.
Small and medium-sized enterprises in particular often underestimate that they operate similar interfaces – for example in online shops, customer portals, booking systems or CRM integrations. If these APIs are not properly secured and attackers obtain credentials via social engineering, the path to a mass data leak is a short one.
The Wind Tre case did not stand alone in July 2026. Other notable GDPR fines of the month:
To find out whether your company is vulnerable to a similar attack, work through the following points:
Following the incident, Wind Tre implemented a whole series of measures: the compromised certificates were immediately revoked, passwords were reset, rate limiting and stricter CAPTCHA thresholds for APIs were introduced, automated access was blocked via a Web Application Firewall (WAF), and multi-factor authentication (MFA) using one-time passwords (OTP) was established. You should implement these steps preventively – before an emergency occurs at your organisation:
The case is highly relevant for GDPR compliance, in particular with regard to two core provisions:
The decisive message for all companies, including SMEs, is: the GDPR requires not only technical protective measures, but also organisational ones. Poor password management or a lack of MFA can already be assessed as a violation. And protecting APIs against enumeration and mass queries is now part of the "state of the art" – anyone who ignores it risks substantial fines.
Dr. Datenschutz sums it up:
„The case illustrates how social engineering attacks work: they circumvent technical protection mechanisms by targeting people. They can only be effectively contained through clearly defined authentication and approval processes, trained staff, and regularly reviewed access rights.“ – Dr. Datenschutz
The figures speak a clear language. The human factor is by far the biggest weak point:
For SMEs and website operators there is a high risk from precisely these attack vectors. Attackers are increasingly using social engineering – from CEO fraud to the fake IT support call – to circumvent technical hurdles. Once they are inside the internal network, inadequately protected interfaces quickly become the Achilles' heel for a mass data leak. The consequences: not only substantial fines, but also severe reputational damage and liability risks towards the affected customers.
The Wind Tre case is a lesson in how an attack begins not at the firewall but on the phone – and how a chain of small negligences ultimately costs 365,000 customers and 1.7 million euros. Certificates stored unencrypted, unprotected APIs without rate limiting, missing MFA, and employees who had no clear process for support requests: each individual one of these gaps would have made the attack harder.
The good news for you: the necessary countermeasures are known, documented, and implementable for companies of any size. Rate limiting, CAPTCHAs, MFA, password managers, regular penetration tests and – perhaps most importantly – trained employees and clear approval processes. Anyone who implements these building blocks now not only protects their customer data, but at the same time meets the GDPR's state-of-the-art requirements. Take the Wind Tre case as an occasion to put your own interfaces and processes to the test today.