Massive data leak hits Italian railway operator Ferrovie dello Stato via Almaviva hack

Massive data leak hits Italy’s Ferrovie dello Stato Italiane after a breach at IT provider Almaviva, with a threat actor claiming the theft of 2.3 TB of sensitive data. The leaked data includes payrolls, contracts, bank details, passenger information such as passport numbers, and extensive HR data for employees across Ferrovie dello Stato Italiane and its subsidiaries.

Files leaked show sensitive internal and confidential documents, trade secrets, forensic reports, and correspondence with government and defence entities, including contracts and agreements with major clients. Almaviva announced it detected and contained the cyberattack, activated security procedures, and kept critical services fully operational while informing authorities and partners, with close coordination ongoing for monitoring and response according to Almaviva.

The sector-wide breach suggests the data may be recent, with items up to Q3 2025, and authorities said the scope of the incident remains under assessment. The notice emphasises that data protection measures are being prioritised as investigations continue, and it notes collaboration with the Public Prosecutor’s Office, the Postal Police, the National Agency for Cybersecurity, and the Italian Data Protection Authority. 21 November 2025.