The Italian bank said the breaches, which occurred via an outside partner last year and during the past two months, related to information on personal loans.
"No data, such as passwords allowing access to customer accounts or allowing for unauthorised transactions, has been affected, while some other personal data and IBAN numbers might have been accessed," the bank said in a statement.
UniCredit said it had immediately taken steps to close the breach and notified the authorities, and intended to file a criminal complaint.