Overview
- Renfe said Friday that attackers used previously compromised Adif servers to obtain limited user information, mainly customer names and email addresses.
- Both Renfe and Adif reported there is no evidence so far that banking details, payment data or national ID numbers were accessed.
- Rail services and operational systems continued to run normally while Renfe isolated affected environments and engaged independent cybersecurity specialists.
- Adif suspended its public websites for more than 24 hours for checks, filed a formal complaint and handed its findings to Spain’s Centro Criptológico Nacional and to affected suppliers.
- The incident follows weeks of blocked intrusion attempts and highlights how interlinked infrastructure and supplier ecosystems can create wider exposure and raise phishing risk for customers.