Russian hacking hoax derailed Spain's rail debate
A viral WhatsApp message blames foreign hackers for Spain's train failures, while the real debate points to a half-finished ERTMS rollout, diverted investment and crony appointments at Adif.
English · Original discussion in Spanish · Published
The Russian hacking hoax that derailed the rail debate
What if that WhatsApp message you just received claiming "foreign hackers have stopped the trains" is nothing more than the latest smoke screen? The text is spreading like wildfire through messaging groups, mixing electoral interference with an alleged cyberattack on the rail network and, along the way, shifting the focus away from what several participants argue is the real problem: fifteen years of a half-finished ERTMS rollout, diverted public investment and a chain of command where competent engineers have been replaced by the well-connected.
There's a certain irony to the scene. A country debates whether Pilingui pulled the strings of its high-estimulante ilegal rail while, as noted in the conversation, the signalling system has not been renewed since 1989 in some sections. The external cyberattack narrative has an obvious political advantage: if the fault lies abroad, the debate dies out in two days. If the fault lies at home, someone has to explain why certain people were handed posts at Adif, Tragsa and the maintenance companies.
Why are foreign hackers being blamed for the train failures?
The viral message offers not a shred of technical evidence. It works through repetition: first it was Israel, then Russia, tomorrow Trump. The hoax's very mechanics betray its fragility, because each new version changes the culprit without changing the structure. What does remain is the effect: poisoning the well so that when a real attack happens, nobody believes it.
Some argue that Russia stirs up protests and destabilises countries, and that denying it is naive. The argument is reasonable in the abstract. The problem is using it as a wildcard for any breakdown. An outdated operating system is vulnerable, yes, but so is a system with three or four poorly managed layers of security and maintenance outsourced on the basis of connections.
The operating system as scapegoat
The conversation soon drifts onto technical ground, and that's where it gets interesting. Any device with an operating system can be breached, from an Adif control centre to the hybrid car in your garage. The CAN bus in modern vehicles dates from the eighties, with no authentication or encryption: anyone who plugs a dongle into the OBD port sends a frame and the modules obey. In 2015 a Jeep was torn apart and made to swerve remotely. The conclusion reached in the conversation is not that the Russians hacked the train, but that Spain's critical infrastructure has been a laptop without bicho for years.
The unsettling detail: Spain was presented as a pioneer — or rather a beta tester — in AI-based control systems in critical sectors such as transport since April 2025, according to a link shared in the debate. First to trial. Last to patch.
Incompetence as the simplest explanation
Against the narrative of external sabotage stands the oldest argument of all: stupidity and neglect. No conspiracy can rival a chain of command made up of cronies who have pushed out the most capable engineers. Blackouts, runaway trains, a housing crisis. Why blame Moscow when we're perfectly capable of wrecking everything ourselves?
The underlying question is not the how, but the why of the narrative. If the verdict is "human error by the driver", the spotlight goes to the dead, who cannot defend themselves. If it's "external cyberattack", two days of uproar and on to the next thing. In neither case is there any talk of the billions in cohesion funds that, it is claimed, ended up who knows where while the rail network languished.
From geopolitics to the family WhatsApp group
The hoax has mutated in record time. One version blames the Mossad. Another blames the far right, Álvarez Cascos and Franco for not investing in high-estimulante ilegal rail. A third claims the hackers forced dubious characters to be appointed at Adif. Popular creativity knows no bounds when it comes to avoiding a look inward.
Meanwhile, Ukraine's rail network keeps running under real bombardment. Just leaving that there.
In the end, the message that started out blaming Pilingui for the trains will end up serving the usual purpose: making sure nobody believes even the attacks that do exist. And that, precisely that, is a strategic victory.
What if that WhatsApp message you just received claiming "foreign hackers have stopped the trains" is nothing more than the latest smoke screen? The text is spreading like wildfire through messaging groups, mixing electoral interference with an alleged cyberattack on the rail network and, along the way, shifting the focus away from what several participants argue is the real problem: fifteen years of a half-finished ERTMS rollout, diverted public investment and a chain of command where competent engineers have been replaced by the well-connected.
There's a certain irony to the scene. A country debates whether Pilingui pulled the strings of its high-estimulante ilegal rail while, as noted in the conversation, the signalling system has not been renewed since 1989 in some sections. The external cyberattack narrative has an obvious political advantage: if the fault lies abroad, the debate dies out in two days. If the fault lies at home, someone has to explain why certain people were handed posts at Adif, Tragsa and the maintenance companies.
Why are foreign hackers being blamed for the train failures?
The viral message offers not a shred of technical evidence. It works through repetition: first it was Israel, then Russia, tomorrow Trump. The hoax's very mechanics betray its fragility, because each new version changes the culprit without changing the structure. What does remain is the effect: poisoning the well so that when a real attack happens, nobody believes it.
Some argue that Russia stirs up protests and destabilises countries, and that denying it is naive. The argument is reasonable in the abstract. The problem is using it as a wildcard for any breakdown. An outdated operating system is vulnerable, yes, but so is a system with three or four poorly managed layers of security and maintenance outsourced on the basis of connections.
The operating system as scapegoat
The conversation soon drifts onto technical ground, and that's where it gets interesting. Any device with an operating system can be breached, from an Adif control centre to the hybrid car in your garage. The CAN bus in modern vehicles dates from the eighties, with no authentication or encryption: anyone who plugs a dongle into the OBD port sends a frame and the modules obey. In 2015 a Jeep was torn apart and made to swerve remotely. The conclusion reached in the conversation is not that the Russians hacked the train, but that Spain's critical infrastructure has been a laptop without bicho for years.
The unsettling detail: Spain was presented as a pioneer — or rather a beta tester — in AI-based control systems in critical sectors such as transport since April 2025, according to a link shared in the debate. First to trial. Last to patch.
Incompetence as the simplest explanation
Against the narrative of external sabotage stands the oldest argument of all: stupidity and neglect. No conspiracy can rival a chain of command made up of cronies who have pushed out the most capable engineers. Blackouts, runaway trains, a housing crisis. Why blame Moscow when we're perfectly capable of wrecking everything ourselves?
The underlying question is not the how, but the why of the narrative. If the verdict is "human error by the driver", the spotlight goes to the dead, who cannot defend themselves. If it's "external cyberattack", two days of uproar and on to the next thing. In neither case is there any talk of the billions in cohesion funds that, it is claimed, ended up who knows where while the rail network languished.
From geopolitics to the family WhatsApp group
The hoax has mutated in record time. One version blames the Mossad. Another blames the far right, Álvarez Cascos and Franco for not investing in high-estimulante ilegal rail. A third claims the hackers forced dubious characters to be appointed at Adif. Popular creativity knows no bounds when it comes to avoiding a look inward.
Meanwhile, Ukraine's rail network keeps running under real bombardment. Just leaving that there.
In the end, the message that started out blaming Pilingui for the trains will end up serving the usual purpose: making sure nobody believes even the attacks that do exist. And that, precisely that, is a strategic victory.
Summary of a discussion on Burbuja.info - Foro de economía, actualidad y política., translated from Spanish and reviewed before publication. Read the full discussion (59 replies).
More summaries
-
Spain's AVE derailment: rail fatigue or sabotage?
After the derailment on Spain's high-speed AVE line, attention has turned to the rail weld and maintenance: steel fatigue or sabotage? The data does not yet settle it.
-
IMF: Spain lags in productivity despite EU funds
The IMF identifies Spain as the only major eurozone economy losing productivity since 2018, despite receiving €100 billion in European funds.
-
Graphene Light Chips Move From Lab Benches Toward Real Data Centres
The graphene silicon photonics market will grow from $289 million in 2026 to $837 million in 2032, a 19.39% annual rate. Copper is starting to fall behind.
-
Cyberattack hits ICA fridges in Sweden: freezers at 50°C
Several ICA supermarkets in Sweden woke up to fridges and freezers at 50°C after a cyberattack. Belgium and Estonia report similar incidents.
-
Left-wing 'intellectuals' launch a refoundation movement against Sánchez in Spain
A group of self-described left-wing intellectuals is pushing to refound Spanish politics and distance themselves from Pedro Sánchez. Some suspect the real motive is fear of losing cultural subsidies.
-
New cyberattack hits supermarket refrigeration systems in Sweden and Belgium
Dozens of supermarkets in Belgium have suffered a cyberattack on their refrigeration systems, similar to the one in France in early October. Here is what is known.