Logotype
Back

Fake Support Techs Breach WINDTRE Retail Stores

About DFIR · Low sophistication
Last updated July 30, 2026

Italy’s privacy regulator fined telecom operator WINDTRE after two breaches where attackers used simple social engineering, not hacking tools. The attackers posed as support technicians and talked retail store staff into giving them system access, leading to theft of customer data. The case shows how frontline staff and store procedures can be the weakest link, even in large telecoms.

What Happened

Italy's data protection authority fined telecom operator WINDTRE 1.7 million euros following two breaches that impacted personal data belonging to more than 365,000 customers. Notably, the regulator found that neither breach involved hacking tools or software exploitation. Instead, attackers posed as support technicians and convinced staff at two WINDTRE retail stores to grant them system access. That access ultimately led to the theft of customer data.

Why This Attack Worked

The pretext was simple: someone shows up claiming to be from support and asks for access to fix a system issue. In a busy retail environment, staff are often trained to be helpful and to resolve technical problems quickly, which makes an unscheduled visit from a claimed technician easy to accommodate rather than question. The regulator explicitly noted that both incidents relied on old-school social engineering rather than software exploitation, underscoring that the weak point was human trust and process, not a technical vulnerability.

Red Flags Defenders Should Recognize

A few warning signs stand out in this scenario:

  • An unscheduled support visit or access request that isn't tied to an internal ticket
  • Pressure to bypass normal access controls or approval steps
  • An inability to verify the visitor's identity through an official directory or a callback to a known helpdesk number

Any of these alone should prompt a pause. Together, they describe exactly the kind of encounter that led to unauthorized system access at WINDTRE stores.

Building Resistance Across Frontline Teams

Organizations with retail, storefront, or field-facing operations can reduce this risk by treating

Key findings

  • Italy’s data protection authority fined WINDTRE €1.7 million after two breaches impacting personal data of more than 365,000 customers.
  • The regulator said both breaches relied on “old-school social engineering rather than software exploitation.”
  • Attackers “posed as support technicians” and persuaded staff at two WINDTRE retail stores to grant them system access.
  • Regulators treated repeat breaches stemming from the same underlying gaps as an aggravating factor.

Who’s being targeted

  • Commonly targeted roles: Retail store staff, Store managers, Customer service/helpdesk, IT support teams, Security & compliance leadership.
  • Affected industries: Telecommunications, Retail (telecom retail stores).
  • Attack channels: physical.
  • Impersonated: Support technician (internal/contracted telecom IT support).

Red flags to watch for

  • Unscheduled support visit or request not tied to an internal ticket
  • Pressure to bypass normal access controls or approvals
  • Identity cannot be verified via official directory/helpdesk callback
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo

Frequently asked questions

How did attackers breach WINDTRE retail stores?

Attackers posed as support technicians and convinced staff at two WINDTRE retail stores to grant them system access, without using any software exploits.

Was this attack technically sophisticated?

No, the regulator described it as old-school social engineering rather than software exploitation, and the incident is rated low sophistication.

Why did regulators fine WINDTRE?

Italy's data protection authority fined WINDTRE 1.7 million euros after two breaches affecting more than 365,000 customers, treating the repeat nature of the incidents as an aggravating factor.

Who should be most concerned about this type of attack?

Retail store staff, store managers, customer service and helpdesk teams, IT support teams, and security and compliance leadership are all named as relevant audiences.

Read the video transcript

In Italy, WINDTRE got hit with a €1.7 million fine… not for hacking, but for someone saying, “Hi, I’m from support.” At two WINDTRE retail stores, someone walked in, posed as a support technician, and talked staff into granting system access, no malware, just persuasion. Here’s the trap: unscheduled visit, “urgent” system issue, and pressure to bypass normal approvals. That’s how over 365,000 customers’ data walked out the door. Your move: if anyone says, “I’m from support, let me in,” pause, and call the official helpdesk to confirm before you grant a single click of access.

MITRE ATT&CK techniques

T1656 · ImpersonationT1598 · Phishing for Information
Original reporting: About DFIR
How we produce these breakdowns

Similar attacks

Kratos PhaaS Fueled MFA-Bypass Phishing

Kratos PhaaS Fueled MFA-Bypass Phishing

Authorities dismantled “Kratos,” a phishing-as-a-service platform used at scale to steal Microsoft account credentials and even bypass MFA by stealing session…

July 24, 2026

See Mirage in Action?

Discover how Mirage exposes your actual human risk, tests defenses, and drives staff training with modern, realistic attack scenarios, long before adversaries seize the opportunity to breach you.

Get a demo