[REVISION HISTORY]

Cyberattack on Spanish railway entities Renfe and Adif

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-09-28 00:12 UTC → 2026-09-29 02:33 UTC · added ~~removed~~

Spanish railway entities Renfe and Adif were targeted by a sophisticated cyberattack, potentially utilizing artificial intelligence to exploit system vulnerabilities. The breach originated in Adif’s digital infrastructure before spreading to Renfe’s cloud systems and various suppliers. Initial reports indicated that approximately 500 gigabytes of data were stolen, which companies described as ‘limited’ information consisting primarily of customer names and email addresses. At that stage, officials ruled out the theft of banking details, financial data, or national ID numbers, and confirmed that railway operations remained fully functional. Subsequent forensic analysis revealed a significantly larger impact, with approximately 150 million data records compromised. ~~While the breach included low-risk and nominative ticket data, investigations later suggested the theft included roughly~~ The stolen information is categorized into three distinct tiers: • 20 million low-risk records containing names and national ID numbers (DNI). • 20 million high-risk records including full names, dates of birth, phone numbers, and postal addresses. • 100 million nominative ticket records, which could allow attackers to potentially map the travel patterns of specific individuals. The attack was neutralized following intervention by Spain’s National Cryptologic Center (CCN). While the breach represents a significant escalation in threats to Spanish critical infrastructure, authorities have stated there is no evidence that sensitive banking or payment information was accessed.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.