Some 400,000 customers of Italy's biggest bank by assets, UniCredit, have had their data hacked into over the past 10 months, but no access codes were stolen, the Milan-based lender said on Wednesday.
"A first breach seems to have occurred in September and October 2016, followed by a second breach, which has just been identified, in June and July 2017," a company statement said. "The data of approximately 400,000 customers in Italy is believed to have been impacted."
"No data, such as passwords allowing access to customer accounts or allowing for unauthorized transactions, have been affected, while some other personal data and IBAN numbers may have been accessed," the bank added.
The hacked data was said to have concerned "personal loans only."
The bank said that the hackers breached the system through an unidentified external commercial partner.
It emphasized that it had previously earmarked 2.3 billion euros ($2.7 billion) to upgrade its IT systems.
An outreach campaign to alert affected customers is planned, and an audit has been launched to investigate the breach, UniCredit said, adding that it also planned to file a criminal report to the Milan prosecutor's office.
