The accounts of some 400,000 customers at Italy's largest bank have been hacked.
The bank, UniCredit, said hackers breached the system through an unidentified external commercial partner.
The system was first compromised last September and October, followed by incursions in June and July. The first breach was not previously disclosed.
The bank said no passwords appear to have been jeopardised, but that personal data, including names and birth dates, along with account numbers "might have been accessed".
The bank said it was filing a criminal complaint with prosecutors and is taking action to close the breach. It emphasised that it had previously earmarked 2.3 billion euro (£2.05 billion) to upgrade its IT systems.