Loading story…
A significant data breach has impacted Italy's national railway operator, Ferrovie dello Stato Italiane (FS), following a compromise at its IT services provider, Almaviva. A threat actor claims to have stolen and leaked 2.3 terabytes of sensitive data, including confidential documents, internal communications, contracts with public entities, technical documentation, financial records, and personal data of passengers and employees. The breach reportedly exposed information marked as confidential or for internal use, as well as privileged communications, trade secrets, and legal documents, affecting multiple FS Group subsidiaries and partners.
Cybersecurity experts have confirmed the authenticity and recency of the leaked data, which includes files from the third quarter of 2025 and is organized in a manner consistent with ransomware group operations. Almaviva, a major IT and digital services provider with over 41,000 employees, has acknowledged the breach. The incident highlights the risks posed by supply chain attacks, as the compromise of a key IT provider led to the exposure of critical infrastructure data and sensitive information across Italy's railway sector.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said the alleged Almaviva compromise may have exposed data belonging to Italian railway operator Ferrovie dello Stato through a third-party relationship. This marked an escalation from a vendor breach claim to a potential downstream customer impact event.
A threat actor claimed to have stolen 2.3TB of data from Italian technology and rail-sector contractor Almaviva. The claim appears to be the first public disclosure of the alleged intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
Eurofiber France experienced a cyberattack on November 13, 2025, in which threat actors exploited a vulnerability in the company's ticket management platform. The breach resulted in the exfiltration of data related to Eurofiber France and its regional brands, including Eurafibre, FullSave, Netiwan, and Avelia, as well as the cloud division operating under Eurofiber Cloud Infra France. The incident was limited to the French business unit, with no impact on Eurofiber's operations or customers in Belgium, Germany, or the Netherlands. Sensitive information such as banking details and critical data stored in other systems was not compromised, and the vulnerability has since been patched. Following detection, Eurofiber implemented enhanced security measures on the affected platforms and worked with cybersecurity experts to support impacted clients. The company notified all affected customers and reported the incident, which included an extortion-related component, to French authorities CNIL and ANSSI. Operational impact was minimal, with customer-facing services remaining fully functional, and additional steps have been taken to prevent further breaches and strengthen overall system security.
Jun 29, 2026