Small and medium-sized businesses are now frequent targets of cybercrime, precisely because they are assumed to be less prepared. A few legal and practical measures go a long way.
The most common attacks
- Invoice and IBAN fraud: a supplier's email is hacked or imitated, and you are asked to pay to a “new” bank account.
- Phishing: messages that trick staff into revealing passwords or opening malicious attachments.
- Ransomware: company data is encrypted and a ransom is demanded.
Under Italian law these can amount to offences such as computer fraud (Article 640-ter of the Criminal Code) and unauthorised access to computer systems (Article 615-ter).
Prevention: legal and practical
- Always confirm any change of bank details by phone, using a number you already have.
- Use two-factor authentication on email and banking, and keep offline backups.
- Make sure contracts with IT providers set out security obligations, response times and liability.
- Train staff regularly and have a written incident response plan.
- Consider cyber insurance, and read what it actually covers.
If you suffer a data breach
If personal data is affected, the GDPR generally requires you to notify the Italian data protection authority (the Garante) within 72 hours of becoming aware of the breach (Article 33), and to inform the people affected when the breach is likely to pose a high risk to them (Article 34). Document what happened and what you did, even if you decide notification is not needed.
Report the crime to the Postal and Communications Police (Polizia Postale), and contact your bank immediately in the case of a fraudulent payment: speed improves the chance of stopping it.
Company liability and compliance
Certain computer crimes are among the offences that can make a company itself liable under Legislative Decree 231/2001. Businesses in critical sectors may also have specific obligations under the NIS2 rules. A compliance review can identify which rules apply to you.
This article provides general information and is not legal advice. Every situation is different: for advice on your case, please contact us.