Italy’s Rail Operator Impacted as Almaviva Suffers Significant Data Exposure

A security incident at IT provider Almaviva resulted in the compromise of sensitive information tied to Italy’s national railway operator, Ferrovie dello Stato Italiane.

 

Almaviva is an Italian ICT group that delivers digital solutions and services for businesses and public administrations. Its offerings span consulting, system integration, cybersecurity, R&D, large-scale system management, and multichannel customer care, supported by a global presence in countries such as Brazil, the United States, and China.

 

Almaviva provides information and communications technology (ICT) services to FS Italiane Group, Italy’s state-owned railway company.

 

Recently, Andrea Draghetti, Head of Cyber Threat Intelligence at D3Lab, reported that a threat actor has claimed to infiltrate the internal network of FS Italiane Group, stole 2.3 terabytes of data and leaked it on a dark web forum.

 

“A threat actor has claimed an attack against Almaviva and the various companies of Gruppo Ferrovie dello Stato Italiane, publishing on a forum of the network TOR an alleged leak of about 2,3 TB of data.

 

“The threat actor declares that the material includes internal shares, multi-society repository, technical documentation, contracts with public entities, HR archives, accounting data and even complete datasets of the diverse companies of Gruppo FS. The structure of the dump, organized into compressed archives per distribution/company, is fully consistent with the modus operandi of ransomware groups and data brokers active in 2024–2025,” Andrea Draghetti said.

 

Draghetti noted that an examination of the published materials makes it clear that much of the information is up-to-date, including explicit references to fiscal, administrative, and operational documents current through Q3 2025.

 

Acknowledging the reports of the data security incident, in a notice published on website, Almaviva said it has identified unauthorised access to its internal network and “and subsequently isolated an information attack that has compromised our corporate systems, leading to the extraction of some data.”

 

The functionality and services of the systems involved continue to operate without interruption, and Almaviva said it is actively collaborating with the relevant law enforcement authorities to carry out a thorough investigation and work toward resolving the incident as swiftly as circumstances allow.