Spanish public railway company Renfe has confirmed that it suffered a cybersecurity incident in which attackers accessed limited traveler information — mainly names and email addresses — through servers belonging to rail infrastructure manager Adif.
In a statement on Friday, Renfe said the incident originated in previously compromised Adif servers that were interconnected with the company's systems. The operator, which transported more than 531 million people last year, stressed that there was no evidence that banking details, payment methods, ID numbers or other particularly sensitive information had been accessed, and no conclusive evidence that the extracted data had been made public.
Weeks of attempted attacks
Renfe said the breach followed "several weeks" of attempted attacks against its technological infrastructure that had been detected and successfully blocked by its defence systems. After the successful intrusion, the company activated internal protocols, isolated the affected environments and deployed containment measures with external cybersecurity experts. Rail services are running normally.
The public company said its investigation remains open, and that it continues to collaborate with the competent authorities to clarify the facts. A Renfe spokeswoman declined to say how many users were affected or when exactly the intrusion occurred.
Reports point to AI-assisted attack
Spanish daily El Mundo, citing sources close to the investigation, reported that a criminal organisation used "a system similar" to Anthropic's AI to attack Adif's website, which was unavailable on Friday evening. The paper described it as the first cyberattack by AI on the website of a Spanish public company, with the incident lasting "several days."
El Mundo and other outlets also reported that the criminals seized 500GB of data, a figure neither Renfe nor Adif has confirmed. According to La Razon, sources with knowledge of the case said "the modus operandi points to a foreign group." Adif has separately reported its incident to Spain's National Cryptological Center and plans to notify the data protection agency once the analysis of compromised information progresses.
Sources:
The Geneva Times: Cyberattack hits Spanish train operator user data
Demócrata: Renfe and Adif investigate a cyberattack on their systems
In a statement on Friday, Renfe said the incident originated in previously compromised Adif servers that were interconnected with the company's systems. The operator, which transported more than 531 million people last year, stressed that there was no evidence that banking details, payment methods, ID numbers or other particularly sensitive information had been accessed, and no conclusive evidence that the extracted data had been made public.
Weeks of attempted attacks
Renfe said the breach followed "several weeks" of attempted attacks against its technological infrastructure that had been detected and successfully blocked by its defence systems. After the successful intrusion, the company activated internal protocols, isolated the affected environments and deployed containment measures with external cybersecurity experts. Rail services are running normally.
The public company said its investigation remains open, and that it continues to collaborate with the competent authorities to clarify the facts. A Renfe spokeswoman declined to say how many users were affected or when exactly the intrusion occurred.
Reports point to AI-assisted attack
Spanish daily El Mundo, citing sources close to the investigation, reported that a criminal organisation used "a system similar" to Anthropic's AI to attack Adif's website, which was unavailable on Friday evening. The paper described it as the first cyberattack by AI on the website of a Spanish public company, with the incident lasting "several days."
El Mundo and other outlets also reported that the criminals seized 500GB of data, a figure neither Renfe nor Adif has confirmed. According to La Razon, sources with knowledge of the case said "the modus operandi points to a foreign group." Adif has separately reported its incident to Spain's National Cryptological Center and plans to notify the data protection agency once the analysis of compromised information progresses.
Sources:
The Geneva Times: Cyberattack hits Spanish train operator user data
Demócrata: Renfe and Adif investigate a cyberattack on their systems
