Cyberattack on Spain’s rail operators

On the night of Thursday 24 September 2026, Adif detected unusual activity in its systems. On Friday 25, Renfe explained that the attackers had used previously compromised Adif servers, interconnected with its own, to reach customer information. Adif suspended its websites as a precaution, restoring them on Saturday 26, and said the systems linked to railway operations were not affected and that trains kept running.

What data was compromised is the least clear part. Renfe spoke of “limited” information about users, mainly names and email addresses, and of no sign of access to bank details, means of payment or ID numbers. A forensic analysis cited on 27 September by the OCU points instead to some 500 GB and more than 150 million records, with data such as ID number, phone, date of birth, address and ticket history. These are figures from media and organisations, not an official inventory.

What is and is not known

Neither Adif nor Renfe has attributed the attack, and there is no conclusive evidence that the data has been published. Several outlets reported that artificial intelligence was used to automate the search for vulnerabilities, but that claim is unconfirmed and investigators must establish it. Adif filed a complaint and notified the incident to the National Cryptologic Centre; Renfe isolated the affected environments and hired independent specialists.

Caution is wise with each new piece of data. In an incident like this, the first figures are often revised up or down as the analysis advances, so official information will be the only reliable kind when it arrives. Meanwhile, affected users should change their Renfe password, as the company asked, and distrust unexpected messages that mention tickets, refunds or account verification.

Duties of whoever processes data

When a company processes personal data, the General Data Protection Regulation requires it to notify the supervisory authority of a security breach within 72 hours of becoming aware of it, unless it is unlikely to pose a risk, and to inform those affected without undue delay when the risk is high. After a breach it must also be documented, its cause analysed and measures adopted to prevent a repeat. The Spanish Data Protection Agency can penalise a lack of adequate measures or of notification.

The duty does not fall only on large operators. Any company with a base of customers, employees or suppliers is a data controller, and its responsibility extends to the processors it hires. It is worth reviewing contracts with suppliers who access your systems and checking that they include security obligations and prompt notice of any incident.

Interconnections and trust

The case illustrates the so-called trust-relationship attack: if a connected partner is compromised, the attacker can reach the target entity without breaching its own perimeter. Adif and Renfe exchange data daily through service accounts, interfaces and connections between systems. Under the National Security Scheme, each interconnection must be authorised and documented in advance.

For a company, the practical steps are to inventory its interconnections with third parties, limit the permissions of service accounts, segment networks, review who can access customer data and test its incident-response plan. Staff should also be warned that leaked travel and contact data make phishing easier, even against the corporate email of those who travel for work. Consult your adviser and your security officer on how to adapt these controls.

A breach at a partner is also a breach of your own: security is measured by the weakest link.

This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.