Adif and Renfe hacked: around 500 GB of passenger data

The incident was detected between 24 and 25 September. According to published accounts, the attackers found a flaw in Adif's website, moved into its cloud and from there reached Renfe systems connected to it. Adif reported the incident to Spain's National Cryptologic Centre, and its websites were back up the next day.

Both companies have been cautious. Renfe speaks of access to a "limited" amount of customer data, mainly names and email addresses, and rules out any impact on banking or payment data. Adif stresses that no railway operations system was compromised. Press reports citing the forensic analysis put the data taken at around 500 GB.

What made the case news is the method: according to investigators, the attackers used artificial intelligence to search for vulnerabilities until they found the one that let them in. An AI doesn't need to invent new flaws; it only has to find the exposed ones before anyone else does.

The attack didn't come through the railway network but through a public website connected to internal systems. That is the pattern behind almost every recent incident: the internet-facing surface —websites, forgotten subdomains, admin panels— is the door, and customer data is what walks out of it.

For passengers, the immediate risk is phishing: emails and texts posing as Renfe and using real data to look credible. For any company, the lesson is to know what it has exposed and whether any of its credentials are already circulating, before someone else's automated tool finds out.