Some cyberattacks begin with sophisticated malware or an unknown software vulnerability. Others begin with a convincing conversation and an account that has more access than it should. A recent enforcement action involving Italian telecommunications company WINDTRE shows why organizations must protect people, credentials, certificates, and access permissions as carefully as they protect software.
What Happened?
Italy's data protection authority fined WINDTRE €1.7 million after investigating two unauthorized breaches that exposed personal information belonging to more than 365,000 customers. According to Reuters, the investigation followed WINDTRE's notification of the incidents in February 2025.
The attackers reportedly presented themselves as support technicians and gained access to corporate systems through employees at two retail locations. This is a form of social engineering: manipulating a person into providing access, information, or an action that helps the attacker.
The exposed information included customers' personal and contact details. Reuters reported that data associated with 41,359 customers also included sensitive payment information, such as bank-account details, partially obscured credit-card numbers, and expiration dates.
The regulator identified weaknesses in the management of access credentials and digital certificates. It also found that the company's security checks had not identified vulnerabilities that more thorough assessments could have detected. WINDTRE was ordered to strengthen credential and certificate protections, introduce secure password-management tools, and improve its cybersecurity controls. The company declined to comment to Reuters.
Why This Matters
Cybersecurity is not only about writing secure code. An organization can patch its applications and still be exposed if an attacker can convince an employee to reveal a credential, approve a request, or trust a fake technician.
People, passwords, accounts, and certificates are attractive targets because they may provide a direct path into a trusted system. Once an attacker appears to be an authorized user, ordinary security tools may interpret the activity as legitimate unless additional controls detect unusual behaviour.
The lesson is not that employees are the problem. Employees need clear procedures, effective training, and technical controls that make one mistake less damaging. Security should assume that credentials can eventually be phished, copied, reused, or otherwise compromised.
Connected Computer Science Concept: Identity and Access Management
Identity and access management, usually shortened to IAM, is the set of policies and technologies that determines who can access a system, how identity is verified, and what an authenticated user is allowed to do.
A basic IAM system answers four questions:
- Identification: Which user, service, or device is requesting access?
- Authentication: How does the system verify that identity?
- Authorization: Which resources and actions are permitted?
- Accountability: Can the organization record and review what the identity did?
A password is only one piece of IAM. Multi-factor authentication, role assignments, device trust, session controls, access reviews, logging, and rapid account revocation all help determine whether access remains safe after login.
Learn This Skill: Least-Privilege Access
The principle of least privilege means giving an account only the permissions required to perform its current job. A retail employee may need to view or update a limited set of customer records, but that does not mean the account should have unrestricted access to an entire customer database.
Least privilege can limit breach impact in several ways:
- Role-based access: Assign permissions according to job responsibilities.
- Limited scope: Restrict users to the customers, locations, and systems relevant to their work.
- Just-in-time access: Grant elevated permissions temporarily and expire them automatically.
- Separation of duties: Require a second person or approval step for sensitive actions.
- Regular access reviews: Remove permissions that are no longer required.
Least privilege does not guarantee that an account will never be compromised. Its purpose is to reduce what an attacker can reach after a compromise.
Credentials and Certificates Need a Lifecycle
Passwords, API keys, access tokens, and digital certificates should not be treated as permanent objects. They need a managed lifecycle from creation to retirement.
- Issue separate credentials to individual users and services instead of sharing accounts.
- Store passwords and secrets in approved management systems rather than notes or messages.
- Use multi-factor authentication wherever possible.
- Rotate high-risk credentials and revoke them quickly after suspicious activity.
- Track certificate owners, purposes, expiration dates, and revocation status.
- Disable dormant accounts and remove credentials that are no longer required.
Digital certificates can authenticate devices, services, or users. If their private keys are mishandled or their ownership is unclear, an attacker may be able to appear trusted. Certificate management therefore belongs inside the IAM and security-monitoring program.
Defending Against Fake Support Requests
A real support technician should be verified through a trusted internal process. Employees should not rely only on a caller's name, confidence, technical vocabulary, or knowledge of company details.
- Provide a documented method for confirming the identity of support staff.
- Prohibit sharing passwords, one-time codes, or private certificate material.
- Use approved remote-support tools with visible consent and audit logs.
- Make it easy to end a suspicious interaction and contact the official help desk independently.
- Alert on unusual locations, devices, access times, or large record queries.
- Run short, repeated social-engineering exercises that teach employees how to respond.
Security Assessments Must Test the Whole System
A vulnerability assessment should examine more than application code. It should also test account permissions, certificate handling, recovery processes, retail access, support procedures, logging, and the organization's ability to detect suspicious use of valid credentials.
This is an example of defence in depth. If one control fails, another should reduce or detect the damage. Training may help an employee recognize a fake technician. Multi-factor authentication may stop a stolen password. Least privilege may restrict the compromised account. Monitoring may identify unusual queries, and rapid revocation may end the session.
Key Takeaways
- Two WINDTRE breaches exposed information belonging to more than 365,000 customers.
- The attackers reportedly impersonated support technicians and gained access through retail employees.
- The regulator identified shortcomings involving credentials, digital certificates, and security assessments.
- IAM controls identity verification, access permissions, and accountability across a system.
- Least privilege limits the resources available to a compromised account.
- Human training and technical controls must work together; neither is sufficient alone.