ADIF (Spanish railway manager) Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In July 2020, ADIF, the public entity responsible for managing Spain’s railway infrastructure, was listed on a leak site operated by the REvil ransomware group. The group claims to have exfiltrated internal files during a ransomware attack, though the number of individuals affected and the precise contents of any stolen material have not been disclosed. This listing occurred amid a wider increase in ransomware operations targeting transportation and critical infrastructure operators, where attackers combine file encryption with the publication of stolen data to increase pressure on victims.

What happened

Public records show that on 1 July 2020 ADIF appeared on the REvil ransomware group’s leak site. The group claims to have stolen internal data. No further technical details, such as the date of initial access, the volume of data taken, or whether encryption was deployed across operational systems, have been made public. The number of people potentially affected is also unknown.

Who is revil?

REvil, also tracked as Sodinokibi, operated as a ransomware-as-a-service group from approximately 2019 onward. It supplied encryption tools to affiliate attackers in exchange for a share of ransom payments and maintained dedicated leak sites to publish data when victims refused to pay. The group’s typical approach involved initial network access through common vectors such as remote desktop services or phishing, followed by data exfiltration and, in many cases, deployment of ransomware. REvil ceased visible activity after law-enforcement actions against its infrastructure in 2021.

ADIF (Spanish railway manager) and its sector

ADIF is the Spanish state-owned company that owns and maintains the country’s conventional and high-speed rail network, including tracks, signalling systems, stations and related operational technology. Entities of this type routinely hold records concerning infrastructure maintenance, supplier contracts, employee credentials and operational planning. A successful intrusion at such an organisation can affect both administrative systems and, in some cases, industrial control environments that support rail traffic.

What data was at risk

The only information released states that internal files were exfiltrated. No inventory of specific file types, databases or personal records has been published. Organisations managing rail infrastructure commonly store employee data, procurement documents, engineering specifications and access credentials; however, whether any of these categories were among the claimed files remains unconfirmed.

Why it matters

Exposure of internal operational documents can reveal details about physical infrastructure and security procedures that are not intended for public release. For individuals whose information may have been stored in ADIF systems, the primary concerns are potential misuse of credentials or personal identifiers. For the organisation, the incident adds to the operational burden of investigating the intrusion and reviewing access controls across both corporate and industrial networks.

What to do if you're exposed

Individuals concerned about possible exposure should change passwords for any accounts linked to ADIF services and enable multi-factor authentication where available. Monitoring bank and government-service accounts for unusual activity provides an additional layer of protection. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in publicly documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.