TeamSystem breach, stolen IBANs: what to do now (4 steps)

TeamSystem, one of Italy's leading business software vendors, has told its customers it detected — on the afternoon of August 24, 2026 — an unauthorized access to its Contabilità in Cloud platform, the software thousands of Italian companies and accountants use to keep their books and manage the invoicing cycle. The intrusion led to the exfiltration of personal data and banking details: according to the breach notifications sent under articles 33 and 34 of the GDPR, the stolen data includes IBANs, accounting records, email addresses and phone numbers. Login credentials, the company says, were not compromised.

The exact number of affected customers has not been disclosed yet, but the potential scale is large: TeamSystem serves hundreds of thousands of businesses and professional firms in Italy, and Contabilità in Cloud is one of its most widely used products. The Italian Postal Police and the Data Protection Authority — which received the mandatory breach notification — are working on the case.

Why is this breach more serious than many others?

Because of the nature of the data. An IBAN paired with accounting records is not a simple contact list: it tells who pays whom, how much and when. In a fraudster's hands it is the perfect foundation for supplier fraud — so-called BEC, Business Email Compromise — where the victim company receives an invoice that is genuine in format, timing and references, but with modified bank details. It is currently the costliest scam for European businesses, and an exfiltrated accounting archive multiplies its effectiveness because it makes every detail believable.

If you are a TeamSystem customer, the actions to take right now are practical

First: check your bank movements of the last few days and enable alerts on every direct debit or outgoing transfer. Second: distrust any email, call or message that references real invoices and asks you to change the IBAN — always verify with a phone call to the contact you already have saved, never to the details contained in the communication itself. Third: brief whoever handles payments in your company, because the coming months are the window in which stolen data gets monetized. Fourth: even though passwords were reportedly not stolen, changing yours and enabling two-factor authentication everywhere is never wasted time.

There is also a broader lesson for every SMB, not just TeamSystem customers

The cloud ERP is today the point where a company's most sensitive data converges: accounting, invoices, contacts, payroll. When you choose a software vendor — or delegate automated processes to AI agents and integrations — the question to ask is not only 'what does this product do', but 'how does it protect my data': certifications (ISO 27001, SOC 2), encryption, access management, incident notification times. The GDPR makes the vendor accountable for data processing, but the trust of your customers and suppliers is paid by you.

A note of fairness, because it matters: suffering an intrusion does not automatically mean having worked badly. Even serious infrastructures get breached. What distinguishes a reliable vendor is what happens next: detection speed, communication transparency, corrective measures. TeamSystem notified quickly and involved the authorities, which is what the regulation requires. The fact remains that for those using these systems every day, vigilance in the coming months is not optional.

If in your company accounting data touches automations, ERP integrations or flows involving invoices and payments, this is the right moment to review who has access to what and how the most sensitive steps are protected. A one-hour audit of payment flows and integrations costs infinitely less than one invoice paid to the wrong IBAN.