Spanish rail operators ADIF and RENFE hit by cyberattack in late September

Renfe and Adif suffered a cyberattack that forced the isolation of the systems connecting the two entities and that is believed to have allowed the extraction of 500 gigabytes of information. Train services and passenger assistance continue as normal.

Renfe and Adif, the two central pillars of Spain's rail system, were hit by a cyberattack in September 2026. The intrusion compromised limited user information and forced the isolation of the systems connecting the two entities. Train services were not affected and passenger assistance continued as normal. Renfe traces the origin of the incident to Adif servers that had already been attacked and that remained interconnected with the operator's systems.

The scale of the breach is measured in data. The intrusion is believed to have allowed the theft of **500 gigabytes** of information, although it is still unknown which files contain that data. Sources close to the investigation cited by **El Mundo** place the peak extraction period on the Thursday and the group responsible has yet to be identified.

## What user data was compromised

Renfe has stated that the attackers mainly gained access to names and email addresses. The operator has found no conclusive evidence that this information has been made public. There is also no evidence of access to banking, financial or payment data, national ID documents or other particularly sensitive information.

It is worth separating what has been confirmed from what remains a working hypothesis. The attackers reaching that data does not miccionan they have published it. The investigation remains open and the origin of the group responsible is still unidentified.

## The night of 24 September and the system isolation

Adif detected unusual activity in its systems on the night of **24 September**. Its cybersecurity tools worked to contain it, respond to the attacks and limit their possible effects, according to sources at the entity. Based on the available technical evidence, Renfe's systems interconnected with Adif's were targeted in the attack.

The company activated its response protocols, isolated the affected environments and deployed extraordinary protection measures with the support of independent cybersecurity specialists. Renfe has linked the incident to several weeks of continuous attempts against its systems. The company says it had detected and blocked those attacks through its protection mechanisms before this intrusion.

## Adif's website under investigation as the entry point

The investigation places the possible initial access on Adif's website. From there, those responsible are believed to have entered its cloud infrastructure and then systems linked to Renfe. Investigators are analysing whether they used an artificial intelligence system to identify vulnerabilities until they found a way in, as reported by **El Mundo**.

The procedure shows similarities with intrusion operations supported by artificial intelligence, although it is also being investigated whether a human error within Adif may have facilitated the initial access. The investigation must still determine how the entry into the systems occurred and what role, if any, artificial intelligence played.

## Complaint filed with the CCN and services still running

Adif filed a complaint and made the information gathered available to the **Centro Criptológico Nacional (CCN)**, Spain's national cryptologic centre, which reports to the intelligence service. The company is working with its technology providers to restore the website, which remains offline.

No application or system related to rail operations has been affected, according to Adif. Rail traffic is running normally and Renfe's website remains operational. The episode leaves an uncomfortable lesson for the sector: the interconnection between operator and infrastructure multiplies efficiency, but it also turns a single weak point into a gateway into two organisations at once.