Italian Regulator Fines Intesa Sanpaolo €31.8 Million Over Unauthorized Customer Data Access
Summary
Italy’s Data Protection Authority fined Intesa Sanpaolo €31.8 million after finding an employee accessed 3,573 customers’ banking data without authorization from February 2022 to April 2024, while internal controls failed to detect the activity.
Key points
- An employee accessed the banking information of 3,573 customers without authorization between February 2022 and April 2024.
- Internal controls failed to detect or prevent the queries, which could reach the bank’s entire customer base.
- The affected accounts included high-risk customers and public figures who the regulator said required stronger controls.
- The regulator said customer notifications were incomplete and sent after legal deadlines.
- The Italian Data Protection Authority fined Intesa Sanpaolo €31.8 million, citing the shortcomings’ severity and duration, the number of customers affected, and the bank’s remediation.
Article Details
- Victim Organization
- Intesa Sanpaolo SpA
- Incident Type
- Unauthorized employee access to customer banking information
- Data Types Exposed
- Banking information
- Affected Records
- 3,573 customers
- Operational Impact
- An employee accessed customer banking information without authorization between February 2022 and April 2024. Internal controls did not detect or block the queries. The regulator also found shortcomings in breach notifications and protections for high-risk accounts.
- Claim Status
- confirmed