Data from Italy's national railway operator, the FS Italiane Group, has been exposed following a security breach at its primary IT services provider, Almaviva.
The hacker claims to have stolen a massive 2.3 terabytes of data and subsequently leaked the files on a dark web forum. The exposed material allegedly includes confidential documents and sensitive company information.
Scope of the Breach
Almaviva, a large Italian firm providing global services such as software design, system integration, and IT consulting, confirmed the breach to local media. The company stated that
its security monitoring services identified and isolated a cyberattack that resulted in the theft of "some data."
Cyber Threat Intelligence experts, including Andrea Draghetti of D3Lab, confirmed that the leaked data is recent, containing documents from the third quarter of 2025. This ruled out the possibility that the files were recycled from an earlier 2022 ransomware attack.
According to the threat actor's description, the material includes:
- Internal shares and multi company repositories
- Technical documentation
- Contracts with public entities
- HR archives and accounting data
- Complete datasets from several FS Group companies
Draghetti noted that the structure of the data dump is consistent with the standard operating methods of ransomware groups and data brokers active in 2024–2025.
The FS Italiane Group is one of Italy's largest state owned industrial companies, managing railway infrastructure, passenger transport, and logistics.
Almaviva stated that it immediately activated security and counter response procedures, ensuring the protection and full operability of critical services. The company has informed all relevant Italian authorities, including the national cybersecurity agency and the country’s data protection authority. An investigation, guided by government agencies, is currently ongoing.
It remains unclear if the data leak includes passenger information or if the breach impacted other clients of Almaviva. The IT firm promised to transparently provide updates as the investigation yields more information.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
