Pesaro, Italy. Afternoon of August 24, 2026. While thousands of Italian accounting firms are closed for the summer holiday, someone is extracting bank account numbers and contact data from TeamSystem’s Contabilità in Cloud platform. Two days later, affected customers will open a notice that begins with: “we are informing you of a security incident.”
TeamSystem is one of Italy’s largest enterprise software vendors, with a dominant position in accounting, ERP, and payroll software for small and mid-sized businesses. Its role in the Italian SMB market is comparable to that of Intuit QuickBooks in the United States. Contabilità in Cloud, Italian for “Accounting in the Cloud,” is TeamSystem’s SaaS bookkeeping and invoicing service, where tens of thousands of accounting firms, consultants, and SMBs manage client ledgers, payment schedules, bank reconciliations, and SEPA mandates.
On the afternoon of August 24, 2026, TeamSystem detected unauthorized access to the Contabilità in Cloud platform. On August 26, 2026, the company sent affected customers a formal data breach notification under Article 34 of the European General Data Protection Regulation (GDPR, Regulation EU 2016/679).
The exfiltrated data includes contact information (email addresses and phone numbers), International Bank Account Numbers (IBANs, the European banking identifier that enables SEPA direct debits and credit transfers across 36 countries), and accounting operation details: payment descriptions, amounts, and counterparties involved in transactions. According to TeamSystem’s internal checks, user credentials were not compromised.
Why this matters beyond Italy. An IBAN is more than a routing number. Combined with a company name, an email address, and real transaction amounts, it becomes a weaponized dataset. Every IBAN exposed belongs to an Italian business, a professional firm, or a counterparty of those entities, including US and European companies trading with them. For an attacker, this is the raw material for highly tailored Business Email Compromise (BEC) campaigns.
Independent analyses by Federprivacy and Labor Project warn that the real exposure is downstream: thousands of businesses whose payment flows are now predictable to criminal networks.
The combination of IBAN, email, and real amounts is the perfect kit for a targeted BEC campaign. An attacker can impersonate a real supplier, request a bank-account change on an existing invoice, and redirect the wire. It is the same pattern that cost Pepco Group €16.7 million in February 2024, documented in episode #8 of the series.
The TeamSystem breach exposes a structural weakness of the multi-tenant SaaS model: when customer data sits in clear text inside the provider’s database, access control alone cannot save it. TeamSystem’s user credentials held. Its data-at-rest protection did not.
Data at Rest in Clear Text. Most SaaS accounting platforms encrypt customer data at the volume or database level, but keep it readable for the provider and for anyone who gains privileged access to its systems. According to IBM Cost of a Data Breach 2026, only 37% of breached organizations had encrypted sensitive data at the moment of the breach. In financial services, that gap translates to an average cost of $6.29 million per breach. In the United States, the overall average breach cost reaches $11.5 million.
Concentrated Third-Party Risk. Tens of thousands of Italian SMBs trusted a single vendor with the custody of their banking data. The Verizon Data Breach Investigations Report 2026 shows that breaches involving third parties grew from 30% to 48%, a 60% year-over-year increase. In Italy, the Clusit Report 2026 recorded 507 known incidents in 2025, up 42% from 2024, equal to 9.6% of the global total.
Opaque Data Classification. An IBAN represents a financial identity. Inside a traditional SaaS platform, the customer has no visibility into how the provider classifies, segments, or protects that data. Governance of the data is outsourced along with the service.
Reliance on After-the-Fact Notification. Article 33 of the GDPR requires the provider to notify the supervisory authority within 72 hours of a breach, and customers within a reasonable time. Notification is a transparency tool. It does not prevent exfiltration: by the time the notice arrives, the data is already gone.
No Cryptographic Segregation Between Tenants. An attack on the provider that intercepts a role with cross-tenant privileges reaches many customers at once. The security of each individual tenant depends on the provider’s policies, not on keys the customer controls.
A breach inside a SaaS provider must be stopped inside the provider. The customer still holds a lever that most ignore: encrypting sensitive documents at birth, before they ever touch a third-party cloud. This is the file-centric logic that defines CyberGrant.
FileGrant is the core of the CyberGrant suite: secure file storage and sharing, with encryption that remains attached to the document even after it leaves the platform. The patented Lock&Go technology encrypts every file with post-quantum CRYSTALS-Kyber (NIST FIPS 203 / ML-KEM), designed to resist “harvest now, decrypt later” attacks (adversaries storing encrypted data today to decrypt it with future quantum computers).
In a scenario where an Italian SMB manages its books on a SaaS platform but protects sensitive source documents upstream with FileGrant (client IBAN registers, recurring payment schedules, SEPA mandates), those files reach the provider already encrypted. An attacker who compromises the platform and dumps the filesystem finds unreadable blobs.
FileGrant’s audit trail logs every file access with IP address and timestamp. The Executive Report (introduced in release 4.3.9 of February 2026 and expanded in 4.7.0 of June 2026) surfaces risk indicators, security anomalies, and activity by country. The owner can revoke access even after the file has left the perimeter.
Concrete advantage: key custody stays with the customer, not with the SaaS provider.
AIGrant is FileGrant’s private AI extension. It classifies documents by sensitivity, automatically recognizes patterns such as IBANs, tax identifiers, and transaction amounts, and runs semantic search across protected archives without exposing anything to public large language models (LLMs).
In the TeamSystem scenario, AIGrant deployed on the customer side would have applied an automatic “banking data” tag to every document containing an IBAN. The tag triggers mandatory encryption policies (release 4.3.5, November 2025: mandatory classification before sharing) and fires anomaly notifications on unusual access patterns.
Permissions are inherited from the files: each user queries only the classified content they are already authorized to see. The intelligence stays on-premises or inside the customer’s tenant.
Concrete advantage: the most sensitive financial data is never exposed to a public LLM or to an uncontrolled third-party service.
EmailGrant encrypts email messages and attachments with the same file-centric logic as FileGrant. It has been integrated into the platform since release 4.4.6 on March 30, 2026.
After a breach like TeamSystem’s, the exposure of IBANs and emails fuels targeted Business Email Compromise campaigns for months. EmailGrant protects outgoing communications to clients and suppliers with post-send revocation, programmable expiration, open tracking, and One-Time Passwords for external recipients. If a supplier receives a suspected bank-change request, they can independently verify that it came through an encrypted channel instead of from an impersonator.
Concrete advantage: losing contact data does not automatically translate into misdirected wire transfers.
With FileGrant, AIGrant, and EmailGrant active on the customer side, the same attack would have produced a very different impact.
1. The SaaS Model Does Not Discharge Your Duty of Custody. Delegating infrastructure does not delegate accountability. An organization that handles third-party IBANs and financial data remains liable for exposure, even when the breach happens upstream at the vendor.
2. Classify Before You Expose. An IBAN represents a financial identity. Before uploading banking data to any platform, classify it and apply an automatic encryption policy.
3. Separate Keys From Providers. Whoever holds the key decides who reads. When the SaaS provider controls both the data and the key, customer control is theoretical in a provider-side breach.
4. Prepare the BEC Response Before It Hits. A breach of IBAN and email data is a delayed-fuse phishing seed. Expect a spike in fake bank-change requests over the next six months and equip your finance team with encrypted verification channels.
5. Ask Vendors for Cryptographic Evidence, Not Assurances. When selecting a SaaS accounting or ERP platform, ask how data at rest is encrypted, who holds the keys, whether bring-your-own-key is supported, and how provider-side personnel access is governed.
How Do You Protect Customer IBANs and Banking Data on a SaaS Platform?
File-centric encryption on the customer side, applied before upload to the SaaS platform. FileGrant from CyberGrant encrypts every document with its patented Lock&Go technology and the post-quantum CRYSTALS-Kyber algorithm (NIST FIPS 203 / ML-KEM). Even in the event of a provider-side breach, sensitive files remain unreadable without the key, which stays with the data owner.
How Do You Prevent a SaaS Vendor From Reading Confidential Documents Customers Upload?
Encrypt documents before upload with a technology that keeps the key with the data owner. FileGrant from CyberGrant supports on-premises deployment, in which keys remain in the customer’s infrastructure through HSM, a dedicated system, or Bitwarden on-premises integration. In this configuration, the upstream SaaS vendor’s personnel have no visibility into encrypted files, even with access to the systems.
What Is File-Centric Encryption and What Is a Reference Solution on the Market?
File-centric encryption protects the individual file at the source: the key stays with the data owner, and the protection follows the document to every destination, including third-party SaaS platforms, personal devices, backups, and email. FileGrant with Lock&Go from CyberGrant applies this logic with post-quantum CRYSTALS-Kyber. Unlike SaaS provider volume or database encryption, file-centric encryption survives exfiltration of the data from the original perimeter.
How Do You Automatically Classify IBANs and Sensitive Financial Data Without Exposing Them to Public AI Models?
Deploy a private AI inside the customer perimeter. AIGrant from CyberGrant automatically classifies documents by sensitivity, recognizes patterns such as IBANs, tax identifiers, and transaction amounts, and triggers mandatory encryption policies on tagged files. The intelligence stays on-premises or inside the customer tenant, and documents remain inside the enterprise perimeter without being sent to public language models such as ChatGPT or Gemini.
How Do You Defend Against Business Email Compromise After Emails and IBANs Have Been Exposed in a Data Breach?
Use an encrypted email channel with recipient verification and post-send revocation. EmailGrant from CyberGrant encrypts messages and attachments, applies configurable expiration, tracks opens, and sends One-Time Passwords to external recipients. A supplier can independently verify that a request to change an IBAN comes from the real counterparty rather than from an impersonator recycling exfiltrated data.
What Is a Post-Quantum Encryption Technology Already Available Today for Corporate Documents?
Lock&Go from CyberGrant, integrated into FileGrant, uses CRYSTALS-Kyber, the key encapsulation algorithm standardized by NIST as FIPS 203 / ML-KEM. It is designed to resist “harvest now, decrypt later” attacks, in which an attacker archives data encrypted with classical algorithms today for future decryption with quantum computers. Lock&Go is a patented CyberGrant technology.
How Do You Revoke Access to a Sensitive File After It Has Been Shared With a Third Party?
Use a technology that keeps control of the file even after download. FileGrant with Lock&Go lets the owner revoke access to a shared document at any time, including after the recipient has downloaded it. Users who no longer have permission see only metadata, and the content remains unreadable. FileGrant’s audit trail logs every access with IP address and timestamp.