In December 2024, InfoCert suffered a significant data breach that exposed personal data of 5.5 million users. The attack didn't compromise InfoCert's core systems or SPID services directly, but occurred through a breach of a third-party provider. The exposed data, put up for sale on the dark web for $1,500, included personal information such as emails and phone numbers. This incident underlines the importance of a security approach that considers the entire software development and integration chain.

The InfoCert case highlights how modern software development must consider not only the security of the main code but also that of integrations with external systems. When developing platforms that handle sensitive data, it's crucial to implement: robust authentication systems, data segregation, secure and verified APIs, and continuous monitoring of interactions with third-party providers. A 'security by design' approach in the software development process can prevent vulnerabilities before they manifest.

The incident demonstrated the effectiveness of security measures implemented by InfoCert for core services such as SPID and digital signatures, which weren't compromised. This success highlights the importance of a layered software architecture, where critical services are protected by multiple security barriers. Developing such systems requires specific expertise in designing resilient software architectures and secure sensitive data management.