- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Postel S.p.A – €900,000 Fine (Italy, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Italy's data protection authority fined Postel S.p.A. €900,000 after a ransomware attack exposed personal data of about 25,000 people. The company failed to protect its systems despite knowing about security vulnerabilities. This case shows the importance of maintaining strong cybersecurity measures to protect personal information.
What happened
Postel S.p.A. was fined for not securing its systems, leading to a ransomware attack that compromised personal data.
Who was affected
Approximately 25,000 individuals, including employees and job applicants, whose personal data was exposed in the attack.
What the authority found
The authority found that Postel S.p.A. did not implement adequate security measures to protect personal data, violating GDPR requirements.
Why this matters
This case highlights the financial risks companies face if they neglect cybersecurity. Businesses must prioritize data protection to avoid severe penalties and safeguard personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 5 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA has imposed a fine of EUR 900,000 on Postel S.p.A. The company suffered a ransomware attack that resulted in the loss of access to files containing personal data of approximately 25,000 individuals. Data subjects included employees, former employees, and job applicants. The compromised data included contact details, identification details, payment details, and criminal records (special category data) of the data subjects. Although the company had been aware of the security vulnerability (following a report from the software manufacturer), it had not updated its systems. For this reason, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data in order to prevent such an incident. Furthermore, the company failed to provide the DPA with sufficient information on the incident.
Related Enforcement Actions (0)
No other enforcement actions found for Postel S.p.A in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
4 July 2024
Authority
Garante per la protezione dei dati personali
Fine Amount
€900,000
Enforcement Tracker ID
ETid-2474
About this data
Cite as: Cookie Fines. Postel S.p.A - Italy (2024). Retrieved from cookiefines.eu
Last updated: