# It knows the train you took. That is what makes it dangerous.

ID: SA-037
Type: Emerging threat · not yet observed
Audience / at-risk group: Rail passengers in Spain, and anyone whose travel records have leaked
Subject: Renfe and Adif data breach, 2026
Sources checked: 2026-09-28

## Lesson
A message that knows real details of your life is not proof that it is genuine. Leaked data can supply those details. Check any refund or booking incident by opening the operator's app or website yourself, never through the link or number in the message.

## Source findings
Xataka, drawing on an El Mundo analysis confirmed by Adif, reports that a cyberattack on Adif reached interconnected Renfe systems and exposed about 500 GB and over 150 million records: identity data (names, national ID numbers, phone numbers, emails, dates of birth, postal addresses) and about 100 million nominative ticket records that can be cross-referenced to reconstruct passengers' travel. The article itself warns that an attacker could use this to write credible messages about a supposed ticket refund or a booking incident. It states that bank and payment data were not compromised.

## Limits
This is an anticipated scenario, not a documented case: there is no known case of this fraud yet. The message is invented by the observatory for illustration; its route, date, seat and amount are fictional, and it does not reproduce any real message or any real person's data. The breach figures are those reported by the cited source and are not independently verified here. Nothing here suggests that Renfe or Adif send such messages.

## Sources
- [Xataka](https://www.xataka.com/seguridad/creiamos-que-hackeo-renfe-habia-expuesto-correos-nombres-eso-solo-era-punta-iceberg) — Reporting on the scope of the Renfe and Adif breach and its phishing risk · 28 September 2026

Original editorial text: CC BY 4.0. Third-party captures, source texts, names and logos retain their own rights.