Trenitalia Suffers Major Data Breach Affecting Millions of Customers Italian rail operator Trenitalia confirmed a cyberattack in October 2025 that resulted in unauthorized access to sensitive customer data. In an email to affected users, the company disclosed that the breach exposed personal details, contact information (email addresses and phone numbers), ticket and loyalty card data, and identity document details though payment information, login credentials, and credit/debit card details remained secure. Upon detecting the incident, Trenitalia immediately contained the breach, secured its systems, and reinforced cybersecurity measures to prevent future attacks. The company reported the incident to Italy’s Data Protection Authority, the National Agency for Cybersecurity, and filed a complaint with the Public Prosecutor’s Office in Rome. Individual notifications to customers were sent only after completing technical investigations, as required by law. While Trenitalia emphasized that no financial or authentication data was compromised, it warned users to remain vigilant against potential fraudulent communications exploiting the breach. The incident has drawn political scrutiny, with opposition parties including Italia Viva, the Democratic Party, Avs, and the Five Star Movement demanding accountability from Transport Minister Matteo Salvini over the handling of the breach.