{"schema_version":"0.10.0","id":"LR-2026-0715","record_version":1,"title":"Renfe cyberattack uses AI techniques to compromise user data in Spain","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Times of India group · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Times of India group · subject to change"}]},"sources_hash":"47d10a784541b9a81f18405accf1272efe4dd401d17342322ab0cbe08d3820ff"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-26","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Spanish railway operator Renfe said a cybersecurity incident originated in servers of the infrastructure manager Adif, which it said had been previously compromised and was interconnected with Renfe's systems. Spanish daily El Mundo, citing sources close to the investigation, reported that a criminal organisation used a system similar to Anthropic's AI to attack Adif's website. Renfe said the attackers were able to access limited user information, mainly names and email addresses, and that there was no evidence of access to bank or financial details, payment methods or IDs. It said there was no conclusive evidence that the data was made public. A Renfe spokeswoman declined to say how many users were affected or when the breach happened. The Adif website was unavailable on Friday evening, and El Mundo reported the incident lasted several days. The sources do not state how the incident was detected.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched, with a bounded scope stated. Fact: the attackers accessed limited user information, mainly names and email addresses.","harm_class":["privacy"],"affected_description":"limited user information, mainly names and email addresses","protected_class_involved":null,"data_categories_exposed":["names","email addresses"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://ciso.economictimes.indiatimes.com/news/cybercrime-fraud/cyberattack-on-renfe-ai-techniques-used-to-compromise-user-data-in-spain/134495933","publisher":"ET CISO","date":"2026-09-26","type":"press","title":"Cyberattack on Renfe: AI techniques used to compromise user data in Spain - ET CISO","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","context.country":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Spanish public railway company Renfe on Friday said it had suffered a cyberattack that compromised some user data, with media reporting that criminals used AI in a first for Spain."}],"impact.harm_class":[{"source_index":0,"quote":"The attackers were able to access limited user information, consisting mainly of names and email addresses"}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The attackers were able to access limited user information, consisting mainly of names and email addresses"}],"impact.affected_description":[{"source_index":0,"quote":"The attackers were able to access limited user information, consisting mainly of names and email addresses"}],"context.country":[{"source_index":0,"quote":"Spanish public railway company Renfe on Friday said it had suffered a cyberattack"}],"context.industry":[{"source_index":0,"quote":"Spanish public railway company Renfe"}],"impact.severity":[{"source_index":0,"quote":"The attackers were able to access limited user information, consisting mainly of names and email addresses"}],"impact.severity_because":[{"source_index":0,"quote":"The attackers were able to access limited user information, consisting mainly of names and email addresses"}],"event.summary":[{"source_index":0,"quote":"Renfe said in a statement that the \"cybersecurity incident\" originated in servers of railway infrastructure manager Adif that were \"previously compromised and interconnected with the company's systems\""},{"source_index":0,"quote":"Spanish daily El Mundo quoted \"sources close to the investigation\" as saying a criminal organisation used \"a system similar\" to Anthropic's AI to attack Adif's website, which was unavailable on Friday evening."},{"source_index":0,"quote":"The attackers were able to access limited user information, consisting mainly of names and email addresses"},{"source_index":0,"quote":"There is no evidence of access to bank or financial details, payment methods, IDs or other particularly sensitive information"},{"source_index":0,"quote":"A Renfe spokeswoman declined to say how many users were affected by the breach or when it happened."},{"source_index":0,"quote":"El Mundo said it was the first cyberattack by AI on the website of a Spanish public company, with the incident lasting \"several days\"."}]},"notes_on_gaps":"Only one press source (ET CISO, citing Renfe's statement and El Mundo). No source names the AI system or its developer; El Mundo's 'a system similar to Anthropic's AI' is an unconfirmed comparison and is not recorded as a model identity. The sources do not state whether an autonomous agent was involved, so agent_involved, autonomy and failure_class are left out. No occurrence, disclosure or detection date is stated beyond 'Friday' and the article date 2026-09-26, so date fields are left out. Records exposed, affected-party count, direct loss and remediation hours are not stated. The duration 'several days' is not an ISO value, so it is left out. Trigger, detection method, responsible party, and remediation are not stated. Judgement: root_cause 'integration' is taken from Renfe's statement that Adif's servers were previously compromised and interconnected; J3 'missing' (network segmentation) is an inference from the word 'interconnected' and is not stated by any source. Severity 'moderate' is a judgement that user data of others was touched within a stated, limited scope. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Times of India group · subject to change)]"},"context":{"industry":"railway","org_size_band":null,"country":"ES","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"According to sources close to the investigation cited by El Mundo, a criminal organisation used a system similar to Anthropic's AI against Adif's website.","quote":"Spanish daily El Mundo quoted \"sources close to the investigation\" as saying a criminal organisation used \"a system similar\" to Anthropic's AI to attack Adif's website, which was unavailable on Friday evening.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Renfe said the attackers were able to access limited user information, mainly names and email addresses.","quote":"The attackers were able to access limited user information, consisting mainly of names and email addresses","source_index":0,"grade":"C"},{"step":"done","text":"Renfe said it had suffered a cyberattack on Friday, and media reported criminals used AI in a first for Spain.","quote":"Spanish public railway company Renfe on Friday said it had suffered a cyberattack that compromised some user data, with media reporting that criminals used AI in a first for Spain.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://ciso.economictimes.indiatimes.com/news/cybercrime-fraud/cyberattack-on-renfe-ai-techniques-used-to-compromise-user-data-in-spain/134495933"]},"analysis":{"sections":{"timeline":[{"text":"Renfe said it had suffered a cyberattack that compromised some user data.","quote":"Spanish public railway company Renfe on Friday said it had suffered a cyberattack that compromised some user data, with media reporting that criminals used AI in a first for Spain.","source_index":0,"when":"Friday"},{"text":"Adif's website was unavailable.","quote":"Spanish daily El Mundo quoted \"sources close to the investigation\" as saying a criminal organisation used \"a system similar\" to Anthropic's AI to attack Adif's website, which was unavailable on Friday evening.","source_index":0,"when":"Friday evening"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://ciso.economictimes.indiatimes.com/news/cybercrime-fraud/cyberattack-on-renfe-ai-techniques-used-to-compromise-user-data-in-spain/134495933"]}}