A cyberattack on Almaviva, an IT service provider for FS Italiane Group (Italy’s national railway operator), led to the exposure of sensitive internal documents, including personal data related to FS Italiane’s operations. The breach occurred due to an unauthorized actor exploiting vulnerabilities in Almaviva’s infrastructure, bypassing defenses and accessing downstream client systems. While no operational disruptions to railway services were reported, the incident compromised business-related documents, some containing personal data subject to GDPR. Investigations are ongoing to determine the full scope of exfiltrated data, with authorities (including Italy’s ACN and European regulators) assessing cross-border implications. The breach underscores third-party risks in critical infrastructure, prompting calls for stricter vendor controls and network segmentation. FS Italiane has intensified monitoring and third-party audits, while Almaviva is addressing vulnerabilities. The incident aligns with Italy’s push for enhanced cyber resilience under its National Cybersecurity Perimeter law, highlighting gaps in supply chain security for vital sectors like transport.

The FS Italiane Group, Italy’s state-owned national railway operator, suffered a severe data breach after a threat actor compromised its IT services provider, Almaviva. The attacker exfiltrated 2.3 terabytes of sensitive data, including confidential documents, HR archives, accounting data, technical documentation, contracts with public entities, and complete datasets from multiple FS Group subsidiaries. The leaked data, described as recent (Q3 2025), was structured in compressed archives by department, aligning with ransomware group tactics. While Almaviva confirmed the breach and isolated the attack, the exposure of internal corporate, financial, and employee records—along with potential public entity contracts—poses critical operational, reputational, and legal risks. Authorities, including Italy’s cybersecurity agency and data protection watchdog, are investigating. The breach’s scope remains unclear regarding passenger data involvement or broader client impact beyond FS, but the theft of multi-company repositories and sensitive business intelligence underscores systemic vulnerabilities in Italy’s critical infrastructure.

The FS Italiane Group, Italy’s state-owned national railway operator, suffered a major data breach after a threat actor infiltrated its IT services provider, Almaviva. The attacker exfiltrated 2.3 TB of sensitive data, including confidential documents, technical documentation, HR archives, accounting data, contracts with public entities, and multi-company repositories from FS Group subsidiaries. The leaked data, organized by department and company, spans recent documents from Q3 2025 and aligns with the tactics of ransomware groups active in 2024–2025.While Almaviva confirmed the breach and isolated the attack, the full scope remains unclear—particularly whether passenger data or other clients beyond FS were compromised. Authorities, including Italy’s national cybersecurity agency, police, and data protection authority, are investigating. The breach risks operational disruptions, financial losses, reputational damage, and potential regulatory penalties, given FS Italiane’s critical role in managing railway infrastructure, freight transport, and logistics chains across Italy. The incident underscores vulnerabilities in third-party IT providers handling state-owned enterprise data.

Ferrovie dello Stato Italiane (FS), Italy’s state-owned railway operator, suffered a massive data breach via its IT provider, Almaviva. A threat actor stole 2.3 TB of sensitive data, including FSE investment plans (2017–2035), internal/confidential documents, trade secrets, forensic reports, legal papers, financial/bank records, and defense-related contracts (e.g., with the Ministry of Defense, Aeronautica Militare, and Guardia di Finanza). The breach also exposed passengers’ personal data (including passport numbers) and detailed employee records (full names, emails, phone numbers, job titles, salaries, and CID) across multiple FS subsidiaries (e.g., Trenitalia, Rete Ferroviaria Italiana, Mercitalia). The leaked data spans recent fiscal, administrative, and operational documents up to Q3 2025, indicating a fresh compromise. While Almaviva contained the attack and protected critical services, the scale of exposed data—covering corporate, employee, customer, and defense-sensitive information—poses severe risks for fraud, espionage, and operational disruption.