Hacker claims 2.3TB data stolen from Italian IT provider Almaviva
A hacker group, ByteToBreach, claimed to have breached Almaviva, a major Italian IT services provider, and stolen 2.3 terabytes of internal corporate data.
Key points
- Hacker group 'ByteToBreach' claimed responsibility for the breach.
- Approximately 2.3 TB of data was stolen from Almaviva's corporate systems.
- Exposed data includes confidential documents, HR archives, accounting data, and contracts with public entities.
Connected intelligence
Signal brief
Follow the organization, likely method and potential impact to explore connected Shadow Tier intelligence.
Organization
- Published
- Nov 20, 2025
- Updated
- Jun 25, 2026
- Confidence
- Medium
- Evidence
- 2 sources
Structured assessment
Signal analysis
This analysis groups the signal by industry, likely incident action and impacted security area.
Threat source
Watch exposure paths that could affect data, operations or third-party trust.
Mentioned entities
Quick context
Questions about this signal
What happened in this signal?
A hacker group, ByteToBreach, claimed to have breached Almaviva, a major Italian IT services provider, and stolen 2.3 terabytes of internal corporate data. The leaked data reportedly includes confidential documents, HR data, contracts with public entities, and accounting data. Almaviva confirmed the cyberattack and data theft, stating that critical services remained operational. The breach also impacted data related to its client, the Italian national railway operator FS Italiane Group.
When was this signal reported?
Shadow Tier lists Nov 20, 2025 as the signal date.
Which organization is connected to this signal?
Almaviva is the organization connected to this public signal.
Explore AlmavivaWhich impact area is relevant?
This signal is connected to data exposure and breach intelligence based on its reported consequences.
Explore data exposure and breach intelligenceRelated signals
Compare shared topics, actors and incident patterns before opening the full signal.
Accenture Confirms Security Incident After 35GB Data Theft Claim
Accenture, a global professional services company, confirmed a security incident in July 2026 after a threat actor, identified as "888," claimed to have stolen approximately 35 GB of data from the company. The stolen data reportedly includes source code, RSA keys, SSH keys, Azure personal access tokens (PATs), Azure Storage access keys, and configuration files. The threat actor advertised the data for sale on a cybercrime forum and provided a screenshot as proof of exfiltration from a private Azure DevOps repository associated with accenture.com. Accenture stated that it is aware of the "isolated matter" and has remediated its source, asserting that there was no impact on Accenture's operations and service delivery. This incident follows previous security challenges for Accenture, including a 2017 exposure of sensitive data on unsecured AWS S3 buckets and a LockBit ransomware attack in 2021.
Related context