It knows the train you took. That is what makes it dangerous.

Audience / at-risk group

Rail passengers in Spain, and anyone whose travel records have leaked

What you can notice

• The attacker opens with facts the victim recognises: their name, a real route and date, perhaps a seat.
• The pretext fits the travel: a refund for a disrupted journey, or an incident with a booking.
• Familiar details lower suspicion, so the request for card or identity data at the end feels routine.
• Unlike generic phishing, each message can be different and personal, which makes it harder to recognise as a campaign.

What the source reports

Xataka, drawing on an El Mundo analysis confirmed by Adif, reports that a cyberattack on Adif reached interconnected Renfe systems and exposed about 500 GB and over 150 million records: identity data (names, national ID numbers, phone numbers, emails, dates of birth, postal addresses) and about 100 million nominative ticket records that can be cross-referenced to reconstruct passengers' travel. The article itself warns that an attacker could use this to write credible messages about a supposed ticket refund or a booking incident. It states that bank and payment data were not compromised.

What this evidence cannot tell us

This is an anticipated scenario, not a documented case: there is no known case of this fraud yet. The message is invented by the observatory for illustration; its route, date, seat and amount are fictional, and it does not reproduce any real message or any real person's data. The breach figures are those reported by the cited source and are not independently verified here. Nothing here suggests that Renfe or Adif send such messages.