What do we know about the data breach at Intesa Sanpaolo?
Adds dropped word 'do' in lead
By Valentina Za
MILAN, Oct 22 (Reuters) -Prosecutors in the southern Italian city of Bari are investigating an alleged data breach at the country's biggest bank Intesa Sanpaolo ISP.MI, in which Prime Minister Giorgia Meloni's account may have been accessed.
Here is what we know about the incident so far.
WHAT HAPPENED?
An Intesa employee at a branch in the small town of Bitonto, close to Bari in the Puglia region, is alleged to have accessed the current account data of around 3,500 customers, including many high profile figures such as Meloni and her predecessor Mario Draghi between February 2022 and April 2024.
WAS THE SYSTEM HACKED?
There has been no cybersecurity breach, Intesa has said. The employee worked in Intesa's agricultural business, an industry where many companies are so small, often a single-person enterprise, that assessing their credit standing means looking at account data. The person had authorisation to access the data.
WHAT KIND OF DATA ACCESS DO INTESA STAFF NORMALLY HAVE?
Aside from employees in specific roles, such as online support staff who need access to all customer accounts, Intesa employees only have visibility on clients whose data they need to see to perform their duties. For example, it could be the data of clients of the branch where they work.
HOW DOES THE CONTROL SYSTEM WORK?
The system is designed to detect anomalies, such as a single account being accessed too frequently over a period of time.
There is no alert threshold linked to the number of data requests by a single employee with permission, who would normally perform hundreds of transactions every day.
The rogue Intesa employee is alleged to have abusively accessed the accounts of around 3,500 customers about 6,600 times, but this was spread over the course of 500 working days, making it difficult for the system to detect anything out of the ordinary.
The control system aims to protect the privacy of all clients and contains no trigger linked to politically exposed people, a category which is relevant instead for checks against money laundering and transaction monitoring.
WERE THE DATA EXPORTED?
Based on the internal checks Intesa has conducted, no data was downloaded, a person close to the matter told Reuters.
WHY DID INTESA INTESA DO?
Intesa has said that once the internal control system flagged an anomaly and initial checks confirmed the irregularities, it started a disciplinary procedure against the employee and a "comprehensive" audit process to get a full picture of the events.
The employee was suspended from work pending the results of the investigation as a precaution, and Intesa informed Italy's data protection authority, providing updates as it probed the matter internally.
Intesa dismissed the employee due to "serious and repeated violations of internal rules, regulations and procedures" after completing the analysis of the events and the disciplinary process. At that point it was also in a position to file a complaint with prosecutors.
The magistrates were already at work because an Intesa customer had filed a complaint with them, when the bank informed them of the breach to their account.
The bank issued a public apology on Oct.13, created a security division and last week appointed as its head a recently retired senior police officer.
Reporting by Valentina Za; Editing by Sharon Singleton
Aset Berkaitan
Berita Terkini
Penafian: Entiti XM Group menyediakan perkhidmatan pelaksanaan sahaja dan akses ke Kemudahan Dagangan Atas Talian, yang membolehkan sesorang melihat dan/atau menggunakan kandungan yang ada di dalam atau melalui laman web, tidak bertujuan untuk mengubah atau memperluas, juga tidak mengubah atau mengembangkannya. Akses dan penggunaan tersebut tertakluk kepada: (i) Terma dan Syarat; (ii) Amaran Risiko; dan Penafian Penuh. Oleh itu, kandungan sedemikian disediakan tidak lebih dari sekadar maklumat umum. Terutamanya, perlu diketahui bahawa kandungan Kemudahan Dagangan Atas Talian bukan permintaan, atau tawaran untuk melakukan transaksi dalam pasaran kewangan. Berdagang dalam mana-mana pasaran kewangan melibatkan tahap risiko yang besar terhadap modal anda.
Semua bahan yang diterbitkan di Kemudahan Dagangan Atas Talian kami bertujuan hanya untuk tujuan pendidikan/maklumat dan tidak mengandungi – dan tidak boleh dianggap mengandungi nasihat kewangan, cukai pelaburan atau dagangan dan cadangan, atau rekod harga dagangan kami, atau tawaran, atau permintaan untuk suatu transaksi dalam sebarang instrumen kewangan atau promosi kewangan yang tidak diminta kepada anda.
Sebarang kandungan pihak ketiga serta kandungan yang disediakan oleh XM, seperti pendapat, berita, penyelidikan, analisis, harga, maklumat lain atau pautan ke laman web pihak ketiga yang terdapat dalam laman web ini disediakan berdasarkan "seadanya" sebagai ulasan pasaran umum dan bukanlah nasihat pelaburan. Sesuai dengan apa-apa kandungan yang ditafsir sebagai penyelidikan pelaburan, anda mestilah ambil perhatian dan menerima bahawa kandungan tersebut tidak bertujuan dan tidak sediakan berdasarkan keperluan undang-undang yang direka untuk mempromosikan penyelidikan pelaburan bebas dan oleh itu, ia dianggap sebagai komunikasi pemasaran di bawah peraturan dan undang-undang yang berkaitan. SIla pastikan bahawa anda telah membaca dan memahami Notifikasi mengenai Penyelidikan Pelaburan Bukan Bebas dan Amaran Risiko mengenai maklumat di atas yang boleh diakses di sini.
