Italy

Matera Local Health Authority

8,600 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-04-29.

Rank · Sector

#151

of 275 in Health Care

Rank · Italy

#314

of 555

Rank · All fines

#1,509

of 3,085

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-04-29
Controller / Processor: Matera Local Health Authority
Sector: Health Care
Quoted Articles: Art. 5 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA has imposed a fine of EUR 8,600 on the Matera Local Health Authority. The controller notified the DPA of a personal data breach due to a ransomware attack by the Rhysida group. The attackers gained access to the System Administrator's credentials, encrypted on-premises virtual machines and compromised backups. The personal data of 93,362 data subjects was compromised, including names, genders, dates and places of birth and tax ID numbers.

Open original source Links to the regulator's original publication or another source.