AI-Driven Cyberattack Exposes Data of Spanish Railway Operators

Thecyberexpress

AI-Driven Cyberattack Exposes Data of Spanish Railway Operators

First seen 28 Sep 2026, 18:19 UTC • •66.5

Article Content

1 / 4

Browse articles

ThreatCluster •September 28, 2026 at 19:12 UTC

•AI was used to automate the entire cyberattack on Adif and Renfe.
•Approximately 500GB of data was exfiltrated, including customer names and email addresses.
•The attack is under investigation by the Centro Criptológico Nacional (CCN-CERT).

On September 25, 2026, a cyberattack targeting Spain's railway operators Adif and Renfe led to the exfiltration of approximately 500GB of data. The attackers employed artificial intelligence to automate the attack, exploiting vulnerabilities in Adif's web infrastructure to gain access to Renfe's systems. Renfe confirmed that customer names and email addresses were compromised, but stated that no sensitive financial information was accessed. The breach is linked to prior unusual activity on Adif's network, which was detected and contained by the organization. The Centro Criptológico Nacional (CCN-CERT) is investigating the incident, which marks a significant escalation in AI-driven cyber threats against critical infrastructure. Both companies have activated incident-response measures and are cooperating with authorities to mitigate further damage.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-25

Cyberattack confirmed by Renfe

Renfe announced a cyberattack that compromised customer data, linking it to Adif's systems.

Thecyberexpress

2026-09-25

Adif detects unusual activity

Adif reported unusual activity on its network and implemented containment measures.

Thecyberexpress

2026-09-28

AI-driven attack reported

Rescana reported the use of AI in the cyberattack, marking a significant escalation in threats.

More articles in this cluster (3)

Threat Graph

22 entities, 49 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (5)

Apt40
Leviathan
Ta2541
TeamTNT
Play Ransomware Group

Technique (8)

Data Breach
Data Exfiltration
T1046 - Network Service Discovery
T1119 - Automated Collection
T1190 - Exploit Public-Facing Application
T1210 - Exploitation Of Remote Services
T1526 - Cloud Service Discovery
T1567 - Exfiltration Over Web Service

Organization (3)

Adif
Endesa
Renfe

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Indicator (5)

adif.es
group.it
renfe.com.no
rescana.com
[email protected]

Relationships

Apt40 uses Data Breach
Apt40 uses Data Exfiltration
Apt40 uses T1046 - Network Service Discovery
Apt40 uses T1119 - Automated Collection
Apt40 uses T1190 - Exploit Public-Facing Application
Leviathan uses Data Breach
Leviathan uses Data Exfiltration
Leviathan uses T1046 - Network Service Discovery
Leviathan uses T1119 - Automated Collection
Leviathan uses T1190 - Exploit Public-Facing Application
Ta2541 uses Data Breach
Ta2541 uses Data Exfiltration
Ta2541 uses T1046 - Network Service Discovery
Ta2541 uses T1119 - Automated Collection
Ta2541 uses T1190 - Exploit Public-Facing Application
TeamTNT uses Data Breach
TeamTNT uses Data Exfiltration
TeamTNT uses T1046 - Network Service Discovery
TeamTNT uses T1119 - Automated Collection
TeamTNT uses T1190 - Exploit Public-Facing Application
Play Ransomware Group uses Data Breach
Play Ransomware Group uses Data Exfiltration
Play Ransomware Group uses T1046 - Network Service Discovery
Play Ransomware Group uses T1119 - Automated Collection
Play Ransomware Group uses T1190 - Exploit Public-Facing Application
Apt40 targets Adif
Apt40 targets Endesa
Apt40 targets Renfe
Leviathan targets Adif
Leviathan targets Endesa
Leviathan targets Renfe
Ta2541 targets Adif
Ta2541 targets Endesa
Ta2541 targets Renfe
TeamTNT targets Adif
TeamTNT targets Endesa
TeamTNT targets Renfe
Play Ransomware Group targets Adif
Play Ransomware Group targets Endesa
Play Ransomware Group targets Renfe
Apt40 related to CWE-200 - Exposure of Sensitive Information
Apt40 related to adif.es
Apt40 related to group.it
Apt40 related to renfe.com.no
Apt40 related to rescana.com
Apt40 related to [email protected]
Apt40 related to T1210 - Exploitation Of Remote Services
Apt40 related to T1526 - Cloud Service Discovery
Apt40 related to T1567 - Exfiltration Over Web Service

Following this threat?

Track Play Ransomware Group, Apt40 and Adif in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This…