UniCredit S.p.A. – €2,800,000 Fine (Italy, 2024)

On 22 October 2018, UniCredit S.p.A. ("controller") notified the Italian DPA of a personal data breach that occurred on 21 October 2018. The breach occurred due to a cyberattack on the controller’s mobile banking portal for customers. Third parties tried to access customer accounts by attempting automatically-generated simple PINs. The mobile banking portal had two vulnerabilities that facilitated the breach. First, the portal made customers’ personal data (first name, surname, tax code, and internal bank identification code) available in HTML responses to authentication attempts, including where attempts were unsuccessful. Second, the controller did not limit the use of simple PINs, making accounts vulnerable to cyberattacks aimed at identifying customer login information (brute force attacks). Due to the HTML response vulnerability, every login attempt gave cyber attackers access to the names, tax codes, and internal bank identification codes of 777,765 present and former customers. In the case of 6,959 of those customers, the cyber attackers also successfully identified the portal PINs. The controller subsequently blocked the identified PINs. The breach did not include the data subjects’ banking data. The controller did not consider the breach high-risk pursuant to Article 34 GDPR. It posted a general notice on its website and gave direct notice only to the 6,959 data subjects whose passwords were identified. The DPA disagreed, finding the breach likely to present a high risk to data subject rights after a preliminary investigation. On 13 December 2018, it enjoined the controller to communicate the personal data breach to all data subjects. The controller subsequently prepared differentiated notices, which the DPA found complied with Article 34(2) GDPR. In a defense brief, the controller argued that it took preventive measures and mitigating controls which exceeded market standards at the time of the breach. Additionally, the controller argued that the breach occurred as a result of its data processor’s negligence. The processor was charged with carrying out vulnerability tests on the controller’s mobile webpage and application. Though it became aware of the mobile portal’s vulnerabilities on 19 October 2018 and identified them as high-level, the processor did not report these to the controller until 22 October 2018. The DPA rejected the controller’s defense and found that it infringed Articles 5(1)(f), 32(1) and 32(2) GDPR. First, it noted that making personal data available to anyone attempting authentication regardless of success is intrinsically risky in the banking sector, where identified customers may be targeted in phishing attempts or similar attacks. Second, the DPA found that the controller’s failure to prevent simple PINs was a high-risk oversight given the frequency of simple brute force cyberattacks in the financial system. The DPA did not consider the processor’s actions in determining that the controller violated Article 5(1)(f), 32(1), and 32(2) GDPR. The DPA issued a € 2,800,000 fine. In doing so, it balanced the large number of data subjects, previous DPA measures resulting from a prior data breach by the controller, and the loss of confidentiality with the controller’s cooperation during the DPA’s investigation, the exclusion of bank data from the breach, and the steps taken to mitigate the breach. The DPA did not issue other corrective measures, taking into account the controller’s mitigations immediately after the breach and the lack of consumer complaints pursuant to Article 77 GDPR.