Italy Fines WindTre €1.7 Million After Hackers Posed as Tech Support to Steal Data on 365,000 Customers

Italy's data protection authority, the Garante, has fined telecom operator WindTre €1,715,600 over two 2025 data breaches that exposed the personal information of more than 365,000 customers — breaches that started not with a line of malicious code, but with a phone call.

According to the regulator's findings, attackers called employees at two separate WindTre retail stores, claiming to be technical support staff, and talked the store workers into granting remote access to their work devices. No malware, no exploited software vulnerability, no phishing link — just a convincing phone manner and a plausible pretext. Once inside, the attackers reached an internal web application used by WindTre's retail network and began pulling customer records directly from the company's database.

The two incidents, both reported to the Garante in February 2025, were strikingly different in scale. In the first, the intruders ran 66 lookups against the customer database, exposing information on roughly 23 people — a minor incident on its own. The second episode was far more damaging: attackers automated the process, incrementing customer ID numbers roughly 2 million times in a systematic enumeration attack that ultimately pulled personal and contact details on 365,048 customers. For 41,359 of them, the exposed data went further, including partially masked payment card numbers, card expiration dates, bank IBANs and postal payment references.

The Garante's investigation concluded that the breach wasn't purely a case of employees being fooled — it also reflected genuine gaps in how WindTre managed access credentials and digital certificates for its internal systems, gaps the regulator said should have been caught by more rigorous security checks before the attackers ever picked up the phone. That combination — a social engineering trick against frontline staff, paired with authentication and certificate management that didn't limit the damage once access was granted — is what pushed the incident from a contained intrusion into a breach affecting hundreds of thousands of people.

WindTre, owned by Hong Kong's CK Hutchison, had already implemented measures including three-factor authentication, CAPTCHA checks, firewalls and activity logging before the attacks, and the Garante credited the company for notifying regulators promptly and cooperating with the investigation — factors that kept the fine below what it might otherwise have been. After the breaches, the company revoked the compromised digital certificates, tightened CAPTCHA thresholds, added rate limiting to its most sensitive APIs, reset passwords, and rolled out staff training aimed specifically at recognizing social engineering attempts.

Beyond the fine, the Garante ordered WindTre to store its digital certificates more securely and to formalize stricter procedures for how certificates are issued, distributed and revoked going forward.

The case is a reminder that the weakest point in a company's security isn't always a server or a piece of software — sometimes it's a store employee on the other end of a phone call, being asked to do something that sounds like routine IT support. The technical safeguards that are supposed to catch what happens next — rate limits, anomaly detection, tighter permissions on internal databases — are exactly what regulators are now requiring companies to prove they have in place, rather than simply assuming a firewall and a login page are enough.