Italy Fines Intesa Sanpaolo Nearly 50 Million Euros in March After Insider Breach Went Undetected for Two Years
Italy's data protection authority hit the country's largest bank with two separate fines totaling nearly 50 million euros for an insider data breach and unlawful customer profiling.
Overview
Italy’s data protection authority, the Garante per la protezione dei dati personali, imposed two separate fines totaling nearly 50 million euros on Intesa Sanpaolo S.p.A. in March 2026, marking one of the largest combined GDPR enforcement actions against a single financial institution. The penalties address an insider data breach that went undetected for more than two years and a separate incident involving the unlawful profiling of 2.4 million customers during a corporate restructuring.
The Insider Breach
On March 30, the Garante announced a 31.8 million euro fine against Italy’s largest bank over what the regulator described as “serious shortcomings in personal data security, due to the inadequacy of the technical and organizational measures adopted.”
A single employee accessed the banking information of 3,573 customers without justifiable reason, conducting more than 6,600 unauthorized queries between February 21, 2022 and April 24, 2024, according to Reuters. The unauthorized accesses were not detected by the bank’s internal control systems for over two years, exposing what the regulator called “significant weaknesses in its monitoring and prevention mechanisms.”
Among those whose data was accessed were individuals holding prominent public positions who should have been subject to enhanced protective controls. The bank notified the Garante of the breach in July 2024, but the regulator found the notification was both incomplete and late. Communication to affected customers only took place after the authority issued a separate enforcement order in November 2024, requiring the bank to contact all affected individuals within 20 days.
Intesa Sanpaolo did not immediately respond to requests for comment, according to Reuters. The employee involved has been dismissed.
The Isybank Profiling Violation
The insider breach penalty came just 18 days after the Garante issued a separate 17.6 million euro fine on March 12 over unlawful customer profiling tied to the launch of Isybank, a fully digital banking subsidiary. The investigation, triggered by numerous complaints from account holders, found that Intesa Sanpaolo had profiled approximately 2.4 million customers to determine which ones to transfer to the new digital-only unit.
The profiling criteria included customer age, frequency of digital channel usage, absence of investment products, and financial balances below a certain threshold. The Garante determined that the bank lacked adequate legal basis for this profiling and that affected customers could not reasonably have foreseen such treatment based on the information they received. Notifications about the transfer were sent during summer months and buried in app archives without adequate prominence.
Customers transferred to Isybank received new IBANs, lost access to physical branches, and were required to manage their accounts exclusively through the app.
What We Don’t Know
- Whether the employee responsible for the insider breach extracted or shared the accessed data with third parties. The Garante’s investigation found no evidence of data exfiltration, but the full scope of the breach’s downstream impact remains unclear.
- Whether additional regulatory or criminal proceedings are underway. Unauthorized access to computer systems carries penalties under Article 615-ter of the Italian Criminal Code.
- How the bank’s corrective measures compare to industry standards. The Garante noted that Intesa Sanpaolo subsequently implemented strengthened controls, which factored into the final penalty amount, but the specific measures have not been made public.
Analysis
The combined penalties of nearly 50 million euros in a single month underscore an increasingly assertive posture from Italy’s data protection authority toward the financial sector. The insider breach case is particularly notable because it involved not a sophisticated external attack but a failure of basic access controls and monitoring, the kind of internal risk that banks are expected to manage as a core competency.
The two-year detection gap raises questions about whether other financial institutions carry similar blind spots in their user activity monitoring systems. The breach highlights a persistent challenge in banking cybersecurity: employees with legitimate system access who misuse it are far harder to detect than external intruders, especially when automated alert systems fail to flag anomalous query patterns.
The case may also set a precedent for how European regulators evaluate timeliness and completeness of breach notifications under GDPR, given the Garante’s explicit criticism of Intesa Sanpaolo’s delayed and incomplete reporting.