Italy's Garante fined WINDTRE €1.7M after attackers just phoned two shops, posed as IT support, and talked staff into handing over system access. That exposed 365,000+ customers, with bank and card details for 41,359 of them. Here's the part worth sitting with: the fine wasn't really for the breach. It was for weak credential controls and security audits that missed holes a proper test would have caught. If your pen test finds nothing, that isn't a clean bill of health. It might just be a bad test.