The Intesa Sanpaolo data breach has resulted in a €31.8 million fine from Italy’s data protection authority, after an investigation found serious lapses in how the bank protected customer data. The case centers on unauthorized access to the banking information of more than 3,500 customers over a period of more than two years, raising fresh concerns around internal threats in the financial sector.

The Intesa Sanpaolo data breach, first reported by the bank in July 2024, turned out to be far more extensive than initially disclosed. Regulators found that a single employee had accessed sensitive banking data of 3,573 customers without any professional justification, making over 6,600 queries ...