Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

UniCredit S.p.a.: Insufficient technical and organisational measures to ensure information security

The Italian DPA has imposed a fine of EUR 2.8 million on UniCredit S.p.a..

€2,800,000 Fine
UniCredit S.p.a.
ITALY
Art. 5 GDPR Art. 32 GDPR
Security Controllers Identification Personal Data Insurance
Feb 8, 2024 Source gpdp.it

Full text

The Italian DPA has imposed a fine of EUR 2.8 million on UniCredit S.p.a.. The bank had suffered a cyberattack on its mobile banking portal, during which the attackers gained access to numerous data (e.g. name, social security number, identification codes) of thousands of customers and former customers. The attackers were also able to determine the PIN to access the portal of over 6,800 customers. During its investigation, the DPA found that the controller had failed to implement appropriate technical and security measures to counter such a cyber attack. The controller also did not prevent customers from using weak PINs. In setting the fine, the DPA considered the large number of data subjects and the seriousness of the breach. However, the fact that the bank took remedial action in good time and that no bank data was affected was taken into account positively.

Industry: Finance, Insurance and Consulting

How it connects

References

Related across sources

C-604/22 IAB Europe v Gegevensbeschermingsautoriteit In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian… CJEU ·Fourth Chamber Mar 7, 2024 IP Address Controllers Personal Data
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… CJEU ·Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision
1 As 183/2023-62 Health insurer must disclose aggregated patient treatment data under Free Access to OAKS Consulting s.r.o. (the company) provided consulting services concerning market access conditions for medicinal products and medical devices. Pursuant to the Czech Act on Free… Supreme Administrative Court Aug 4, 2026 Pseudonymization Anonymization Personal Data
C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
BA-6S/221/2019 Court upholds €50,000 fine on Sociálna poisťovňa for sending sensitive data by ordinary Sociálna poisťovňa, the social insurance agency (the controller), processes applications for foreign invalidity pensions and forwards related documents to the social insurance… Jun 25, 2025 Integrity and Confidentiality Principle Personal Data Data Breaches
Related documents