Breaches and incidents

Renfe and Adif (Spain): breach of previously compromised Adif servers exposes Renfe customer names and emails

Adif detected “unusual activity” on the night of Thursday 24 Sep and suspended its websites for some hours.

What happened

Adif detected “unusual activity” on the night of Thursday 24 Sep and suspended its websites for some hours; Renfe opened an investigation into a cybersecurity incident on Friday 25 Sep and said the attackers accessed a limited volume of customer data “consisting mainly of names and email addresses” (Alicante Plaza/EP, Roams).
Root cause per Renfe and the Ministry of Transport: intrusion through Adif servers that had been previously compromised and were interconnected with Renfe systems, after “several weeks of continuous attack attempts” against Renfe that were detected and blocked (Escudo Digital).
No attacker named in official statements; some press claims of AI use and data volumes are not confirmed by either company.
Renfe says there is no sign of access to banking, payment or DNI data, isolated affected environments and engaged independent specialists; Adif said no rail-operation system was affected, filed a complaint and notified the CCN.