Trenitalia Data Breach: Hackers Access Customer Travel Records

Trenitalia, Italy's national railway operator and one of Europe's largest rail companies, confirmed in late June 2026 that it had suffered a significant cybersecurity incident. Unknown external actors gained unauthorised access to personal data linked to travel tickets, potentially affecting millions of customers. The company began notifying affected customers by email, describing the incident as caused by "unidentified external subjects."

According to Trenitalia's initial communications, the breach affected personal data associated with ticket purchases, which could include names, email addresses, travel dates and routes, and in some cases payment-related information. The company stated that no account passwords and no payment card details were compromised in the incident. The breach has been reported to the Italian Data Protection Authority, the Garante, as required by EU privacy law.

The Trenitalia breach is the latest in a series of high-profile cyberattacks on European infrastructure companies. Transport operators, energy utilities and public services have become increasingly attractive targets for cybercriminals and state-sponsored hackers, who exploit the combination of large customer databases, complex legacy IT systems and the reputational damage that a public disclosure causes.

The incident raises important questions about the cybersecurity posture of Europe's critical infrastructure. As rail, energy and water systems become increasingly digitised and interconnected, the attack surface available to malicious actors grows correspondingly. European regulators have introduced new rules — including the NIS2 Directive — requiring operators of essential services to meet stricter cybersecurity standards, but implementation has been uneven.