Italy’s data protection regulator fined Intesa Sanpaolo €31.8 million over insider data breach

The Italian Data Protection Authority fined Intesa Sanpaolo €31.8 million after finding an employee made over 6,600 unauthorized queries into 3,573 customer accounts between February 2022 and April 2024; the investigation cited inadequate technical and organizational measures, failures in monitoring controls (including for high-risk individuals), and late/incomplete breach notifications, with the fine reflecting the severity, duration, and subsequent corrective actions.