The Intesa Sanpaolo data breach was not just the result of unauthorized access, but also a failure to detect it that lasted for more than two years. In an exclusive response to The Cyber Express, the Italian data protection authority clarified that the bank’s monitoring systems were not equipped to detect repeated, low-volume access abuse over time.
See also: What the Kash Patel email breach really means
The Intesa Sanpaolo data breach, which has already resulted in a €31.8 million fine, involved a single employee accessing the data of over 3,500 customers without any valid business reason. While previous findings established the scale of the incident, the latest response explains why it went undetected for so long.
At the heart of the Intesa Sanpaolo data breach lies a critical gap in how internal activity was monitored. In response to questions from The Cyber Express, the Secretary General of the Italian Data Protection Authority, Luigi Montuori, said: “The Authority found that the employee carried out unauthorized access for more than two years without the bank’s alert systems detecting any anomaly. According to the decision, the controls adopted by the bank proved to be insufficient in light of the specific risks associated with its operating model, which allowed widespread internal access to customer data.”
This clarification is important. It shows that the Intesa Sanpaolo data breach was not ignored due to a lack of controls, but because those controls were not designed to detect how insider threats actually behave.
See also: Iran: Hackers breached FBI Director's personal email
Rather than triggering alerts through large or unusual spikes, the access remained under the radar, scattered over time. This reveals a common blind spot in business monitoring, where systems often focus on volume rather than patterns.
Another key question in the Intesa Sanpaolo data breach was whether the data obtained was used beyond internal viewing. Even without a confirmed data extraction, the Intesa Sanpaolo data breach was treated as a serious breach. The regulator’s position is clear: prolonged unauthorized access, especially when it involves sensitive and high-profile individuals, creates an inherent risk.
This reflects a broader shift in enforcement, where exposure itself, not just proven abuse, is enough to trigger regulatory action. Following the Intesa Sanpaolo data breach, the bank introduced several measures to strengthen its controls.
While these steps address key weaknesses, they also highlight a larger issue. In the Intesa Sanpaolo data breach, the most critical safeguards—effective monitoring, tighter access control, and risk-based oversight—were only strengthened after the breach had already been ongoing for years.
See also: Dutch Police: Breach via phishing attack
The Intesa Sanpaolo data breach offers a clear lesson for the banking sector and beyond.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
