Intesa Sanpaolo Missed Unauthorized Access for 2 Years, Regulator Reveals

The Intesa Sanpaolo incident involved a single employee who made unauthorized repeated access to over 3,500 customer records across more than two years without detection due to monitoring systems that focused on volume rather than time-distributed anomalous behavior; the Italian Data Protection Authority fined the bank €31.8M, flagged inadequate alert thresholds and access controls, and recorded post-incident remediation measures while noting no confirmed external data exfiltration.