The company said it had discovered evidence of what could be “phenomena linked to a cryptolocker infection” on its computer network on Wednesday morning, according to La Stampa newspaper.
Italian security sources said the nature of the attack made it highly likely it was the work of Russian hackers, according to Italian news agency ANSA.
It led to the temporary closure of ticket booths and the deactivation of self-service ticket machines in stations, as a precautionary measure.
The services were still down as of Wednesday afternoon, according to ANSA.
Online ticket services were operating as normal.
Trenitalia said passengers could board trains and purchase tickets directly from the conductor without any surcharges.
