Wind Tre: €1.72M GDPR Fine After Social Engineering Attack

Published on 1 August 2026

One phone call, one false identity, one granted remote access – and the data of 365,048 customers ended up in the hands of attackers. Italian telecommunications group Wind Tre must pay a GDPR fine of 1,715,600 euros. It was imposed by the Italian data protection authority Garante on 14 May 2026, and the decision was published on 16 July 2026. The case is so instructive for small and medium-sized enterprises because it shows: existing security measures such as multi-factor authentication and firewalls offer no protection when central gaps are overlooked – and because the authority explicitly rejected the popular excuse that "it was just human error".

What happened?

Wind Tre S.p.A., one of Italy's largest telecommunications providers (owned by CK Hutchison Holdings), reported two data breaches to the Garante at the start of 2025 – exemplarily and on time in accordance with Art. 33 GDPR, which requires personal data breaches to be reported within 72 hours. The first report was made on 20 February 2025, the second on 28 February 2025. Both incidents occurred in quick succession at two different branches of the company.

The attack path was the same in both cases – and alarmingly simple. The attackers phoned employees at Wind Tre branches, posed as support technicians and convinced the employees to grant them remote access to the company devices. This method is called social engineering – the targeted psychological manipulation of people in order to gain access to credentials or systems. The telephone variant is also known as vishing (voice phishing).

Once remote access had been granted, the attackers found the digital certificates and credentials on the devices in plain text – stored unprotected. This gave them all authentication factors (the three-factor authentication including certificate and passwords) and allowed them to log in to the company's internal web application.

In the first incident, the attackers carried out 66 targeted database queries and extracted the data of around 23 customers. The second incident was significantly more serious: here the attackers discovered a technical vulnerability and exfiltrated the data of 365,048 customers – including names and contact data as well as, for 41,359 customers, payment data such as postal orders, IBAN and partially redacted credit card numbers with expiry dates.

The technical background – explained clearly

The actual data exfiltration in the second incident used a technique called enumeration. Here, attackers systematically increment a numerical value in order to obtain all available records. Specifically, the attackers incremented the customer identifier (customerId) step by step and made a total of around 2 million requests to what are known as secondary, internal APIs.

An API (Application Programming Interface) is a technical interface through which software systems exchange data. The problem: these secondary APIs at Wind Tre had neither rate limiting (a restriction on how many requests are permitted per unit of time) nor CAPTCHA protection (the small check as to whether a human or a machine is making the request). This allowed the attackers to retrieve records en masse without triggering an alarm.

The Garante identified two central technical shortcomings:

• Inadequate management of certificates: Digital certificates and private keys were not stored in encrypted vaults or dedicated key management systems (KMS) or hardware security modules (HSM), but were accessible on the devices in plain text.
• Missing protection of secondary APIs: Wind Tre's security checks (vulnerability assessments and penetration tests) covered only the main APIs. The secondary APIs through which the attack ran were not tested – even though protecting such interfaces is in line with the OWASP API Security Top 10, an internationally recognised security framework for APIs.

The defence – and why it failed

Wind Tre argued that the incidents were solely attributable to unavoidable human error and not to system vulnerabilities. The company pointed to measures already in place: three-factor authentication, CAPTCHA, firewall, nightly access blocking and weekly monitoring.

The authority did not accept this line of argument. Its decision No. 348 states:

"In connection with the data breach that occurred, Wind Tre displayed significant technical and organisational shortcomings which – if identified in time – would have enabled both more precise management of the certificates and authentication data and an integrated approach to vulnerability assessments and penetration tests, whereby the attack and the mass exfiltration of customer data might have been prevented."
– Garante, fine decision No. 348

Sinisa Markovic of Help Net Security sums it up succinctly: "The company said the incidents were down to human error, independent of system vulnerabilities. The authority rejected this defence and pointed to two technical failures: the handling of certificates and API protection."

When calculating the fine, however, several points had a mitigating effect: the prompt reporting of the data breaches, the corrective measures taken after the incidents, cooperation during the investigation and the absence of prior data protection violations.

Who is affected – and why does this also concern SMEs in Germany?

At first glance the case concerns a large Italian corporation. But the underlying errors are universal and occur just as much in small and medium-sized enterprises. The fundamental GDPR obligations are identical for all controllers – only the size of the fine is based on turnover.

The case is particularly relevant for website operators: many SMEs run websites containing customer data – contact forms, online shops, member areas – and use APIs or CMS systems (content management systems such as WordPress) that can have similar vulnerabilities. The absence of rate limiting on login forms or APIs is a widespread problem that can lead precisely to such enumeration attacks.

The figures underline the urgency: 98% of all cyberattacks involve some form of social engineering, according to Sprinto/Secureframe (2026). 46% of SMEs experienced a cyberattack in 2025 (StationX). In Germany in 2024, around 80% of the ransomware attacks analysed were directed against SMEs (FZI, based on the police crime statistics). And the average cost of a data breach reached a record high of USD 4.99 million in 2026 (IBM Cost of a Data Breach Report 2026).

How to check whether you are affected

This is less about a single software vulnerability and more about organisational shortcomings. Work through this checklist:

1. Check certificate storage: Are digital certificates and private keys stored in encrypted vaults, KMS or HSM – or do they lie unprotected on desktops, in folders or in the browser cache?
2. Audit password management: Do all employees – including external service providers – use a password manager with zero-knowledge encryption? Are passwords never stored or shared in plain text?
3. Inventory API security: Create a complete list of all APIs of your web applications – main as well as secondary. For each, check whether rate limiting, CAPTCHA and authentication protection are active.
4. Review test scope: Do your security tests really cover ALL APIs and endpoints – not just those classified as "primary"?
5. Test social engineering resilience: Carry out simulated phishing and vishing tests, especially for employees in customer and support contact roles.
6. Review remote access policies: Is it clearly documented when remote access is permitted? Do employees know that they must never grant unsolicited remote access?
7. Check reporting process: Is there a documented process for reporting data breaches within 72 hours in accordance with Art. 33 GDPR?
8. OWASP comparison: Compare your API security against the OWASP API Security Top 10 (2023), especially regarding Broken Object Level Authorization, Unrestricted Resource Consumption and Security Misconfiguration.

What you need to do now

After the incidents, Wind Tre implemented a whole series of measures – and the Garante additionally ordered it to strengthen the protection of credentials and certificates and to introduce secure password management tools. These specific steps can be applied to any company:

1. Store certificates and keys securely: Store digital certificates and private keys exclusively in encrypted vaults, KMS or HSM. Alternatively: smart cards or USB tokens that prevent the export of private keys.
2. Introduce a password manager: Company-wide, with zero-knowledge encryption, for all employees, service providers and partners – combined with OTP (one-time password) as an additional factor.
3. Strengthen multi-factor authentication: Supplement existing MFA with time-based one-time passwords (TOTP via authenticator app) or hardware tokens. Compromised static credentials alone must not grant access.
4. Rate limiting and CAPTCHA for ALL APIs: Protect all interfaces – including internal and secondary ones. Follow the OWASP API Security Top 10 (2023).
5. Comprehensive security tests: Extend the scope of vulnerability assessments and penetration tests to ALL APIs and endpoints. Simulate realistic attacks such as enumeration.
6. Social engineering training: Regularly train all employees, especially support and customer contact staff, on vishing, phishing and pretexting. Carry out simulated tests (Wind Tre now uses "mystery call tests").
7. Remote access policies: Replace telephone support with verifiable, authenticated channels such as integrated chat systems.
8. Data breach response plan: Document an incident response plan that takes into account the 72-hour reporting obligation (Art. 33) and the obligation to notify data subjects (Art. 34).
9. Bind service providers contractually: All external partners must be obliged to comply with your security standards. The Garante has made clear that contractual or employment-law arguments are no excuse for missing security measures.
10. Monitoring and anomaly detection: Alerts for unusual patterns – such as mass, sequential queries with an increasing ID parameter – with automatic blocking.

GDPR classification: why this case sets a precedent

The fine is based on Art. 5(1)(f) GDPR (integrity and confidentiality) and Art. 32 GDPR (security of processing). The central message for all controllers: protection against social engineering is part of the required technical and organisational measures (TOM). "Human error is unavoidable" does not hold up as an argument.

GRC Report puts it in context: "The decision demonstrates the ongoing focus of supervisory authorities on whether organisations maintain effective technical and organisational safeguards – particularly where avoidable weaknesses in identity and access management contribute to large-scale data breaches."

Comparable cases show that German authorities are by no means toothless here: Vodafone Deutschland received a record fine of 45 million euros in 2025, among other things because of authentication vulnerabilities and inadequate oversight of processors. 1&1 Telecom GmbH had to pay in 2019 for inadequate telephone authentication (originally 9.55 million, later reduced to 900,000 euros). Federal Data Protection Commissioner Specht-Riemenschneider made it clear: "Data protection law is therefore not toothless, as is sometimes criticised. We are happy to prove the opposite."

To give a sense of scale: since 2018, GDPR fines totalling more than 6.31 billion euros have been imposed across Europe (GDPR Enforcement Tracker, as of August 2026). Violations of Art. 32 GDPR can be penalised with up to 10 million euros or 2% of annual global turnover – in addition to possible claims for damages by data subjects under Art. 82 GDPR as well as reputational damage.

Conclusion

The Wind Tre case is a lesson in two acts: a simple phone call opened the door, an unprotected API emptied the data store. Together, both cost 1.72 million euros. The crucial lesson for SMEs is: security measures on paper are not enough. Anyone who has MFA, CAPTCHA and a firewall but leaves certificates lying around in plain text and never tests secondary APIs has an open flank. Suja Viswesan of IBM Security captures the new reality: "What is changing is the economics of cyberattacks. AI is making attacks faster and cheaper, while data breaches are becoming ever more expensive."

Take on the checklist for auditing and protection in this article. Most of the points cost little – a password manager, a rate limit on your forms, employee training and a documented reporting process. What they can save you is far more: the trust of your customers, your good reputation and a hefty fine.