started · updated
Renfe and Adif hit by AI-driven cyberattack compromising user data
Spanish rail operator Renfe and infrastructure manager Adif have confirmed they were victims of a cyberattack that compromised user data. The breach originated in Adif's servers, which were previously compromised and interconnected with Renfe's systems.
Preliminary investigations indicate that attackers accessed approximately 500 gigabytes of data. The compromised information is described as “limited,” consisting primarily of customer names and email addresses. Renfe stated there is no evidence that this data has been publicly released, nor is there evidence of access to sensitive information such as banking details, payment methods, or national ID numbers.
Reports suggest the attack was highly sophisticated, potentially utilizing artificial intelligence—specifically a system similar to Anthropic’s AI—to identify system vulnerabilities. This marks a notable instance of AI-driven cyberattacks targeting a Spanish public entity.
Adif detected unusual activity late on a Thursday. In response, both companies activated security protocols, isolated affected environments, and engaged independent cybersecurity specialists. While Adif's website was rendered unavailable for several days, both organizations emphasized that rail traffic and services remain fully operational and unaffected.
Entities
Adif · Anthropic · National Cryptologic Centre · Renfe · Spain
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 19 SOURCES] The cyberattack resulted in the exposure of limited user information, primarily names and email addresses. www.lacronicabadajoz.com · www.elcorreoweb.es · theobjective.com · www.todoalicante.es · cronicadecantabria.com · +14 more
- [● 17 SOURCES] Affected environments were isolated and response protocols were activated immediately. www.lacronicabadajoz.com · www.elcorreoweb.es · theobjective.com · www.todoalicante.es · cronicadecantabria.com · +12 more
- [● 19 SOURCES] There is no evidence that banking, financial, payment, or ID data was accessed. www.lacronicabadajoz.com · www.elcorreoweb.es · theobjective.com · www.todoalicante.es · cronicadecantabria.com · +14 more
- [● 6 SOURCES] The attack was a sophisticated operation utilizing artificial intelligence to exploit vulnerabilities. www.lacronicabadajoz.com · theobjective.com · www.upday.com · elburgado.com · information.tv5monde.com · +1 more
- [● 5 SOURCES] Approximately 500 gigabytes of data were stolen during the attack. theobjective.com · www.upday.com · elburgado.com · information.tv5monde.com · www.kyivpost.com
- [● 15 SOURCES] Railway services remain fully operational and guaranteed for travelers. www.lacronicabadajoz.com · www.elcorreoweb.es · theobjective.com · www.todoalicante.es · www.farodevigo.es · +10 more
- [● 12 SOURCES] Adif detected unusual activity in its systems late on a Thursday. www.elcorreoweb.es · www.todoalicante.es · cronicadecantabria.com · www.farodevigo.es · www.3cat.cat · +7 more