Italy

NIER Ingeriegna S.p.A. SB

120,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-14.

Rank · Sector

#89

of 331 in Finance, Insurance and Consulting

Rank · Italy

#79

of 595

Rank · All fines

#464

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-14
Controller / Processor: NIER Ingeriegna S.p.A. SB
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA has imposed a fine of EUR 120,000 on NIER Ingeneriegna S.p.A. SB. NIER is a consultancy firm offering engineering, sustainability and software services. The controller informed the authority about a data breach caused by a ransomware attack. The affected data concerned the personal data of employees and employees of clients of the firm, in total around 500 data subjects were affected. The attackers used stolen credentials to access the internal network via a VPN. The controller failed to implement adequate security measures, such as multi-factor authentication and blocking certain credentials from accessing the network.

Open original source Links to the regulator's original publication or another source.