BusItalia

BusItalia is an organization headquartered in Italy, with its main administrative offices located in the country. It maintains a public-facing website and a mobile application that serve as the primary digital interfaces through which users interact with the organization's services. These digital channels are employed to deliver an online ticketing system that enables customers to browse, select and purchase transportation-related tickets and passes. Beyond ticket sales, the platforms also support user account management, allowing individuals to store preferences, view travel history and receive service notifications.

Through these services, BusItalia collects and processes certain categories of personal data, specifically users’ demographic details, location information and contact details. The organization delegates particular data‑processing functions to an external third‑party provider, which assists in managing the storage and handling of this information. In the incident disclosed on March 30, 2025, unauthorized actors gained access to BusItalia’s website and mobile application, thereby obtaining the aforementioned demographic, location and contact data while payment and banking information remained unaffected. The breach was identified not through internal monitoring but after the external data‑processing provider notified BusItalia of a possible compromise, prompting the organization to take immediate protective measures. As a protective measure, BusItalia temporarily suspended its online ticketing system and disabled user accounts to prevent further unauthorized access while it investigated the scope of the incident.

Subsequently, the organization filed a formal report with the Italian data protection authority, fulfilling its legal obligation to notify the regulator of the personal data breach. BusItalia also reached out to its data‑processing provider to request clarification on how the compromised data had been handled and to seek assurances regarding future safeguards. These steps reflect the organization’s adherence to data‑protection regulations and its response strategy when faced with a security incident involving user information. No additional information concerning BusItalia’s overall size, employee count, geographic reach, ownership structure or parent‑subsidiary relationships is available in the supplied sources.