Renfe and Adif confirm cyberattack exposing 500 GB of customer data

September 26, 2026 at 06:57 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Spain's state rail operators Renfe and Adif confirmed a cyberattack that leaked 500 GB of customer data. The attack, first reported by El Mundo, used artificial intelligence to find vulnerabilities and access both companies' systems. Train services were not affected, and both companies have notified authorities.

Key Facts

The cyberattack leaked 500 GB of private customer information from Renfe and Adif.
The attack used artificial intelligence to scan for vulnerabilities and access both companies' systems.
Renfe stated that only limited, non-sensitive information was accessed, excluding payment details and ID numbers.
Adif confirmed that no railway operations systems were affected and train circulation continues normally.
The incident was reported to Spain's National Cryptologic Centre and the CNI.

Attack Details

The first attack targeted Adif's website, where AI searched for vulnerabilities until finding a backdoor. From there, the unidentified criminal group moved to Adif's cloud and then accessed Renfe's website. The hack lasted several days, with Thursday marking the peak of data theft. Investigators are still analyzing the exact contents of the stolen half-terabyte of data. A human error may also have contributed, pending a deeper investigation by the National Cryptologic Centre and CNI.

Company Response

Renfe confirmed the cyberattack on the external system associated with Adif. Renfe stated that only limited information was accessed, not sensitive data like payment methods or ID numbers. El Mundo reported that most stolen data consists of the traveler database, which does not store credit card details. Adif said its websites, including Adif Alta Velocidad, are operational again after security checks. Adif confirmed that no railway operations systems were affected and circulation is normal.

AI Role

Sources close to the investigation told El Mundo that the cybercriminals used a system similar to one employed by Anthropic's AI. Anthropic documented a comparable AI-driven cyberattack by China-linked hackers in November 2025. This marks the first known use of AI in an attack against Spain's state administration.