During the pre-inauguration tests of the Madrid-Seville AVE in the spring of 1992, engineers placed a lit cigarette standing upright on a table in the dining car. The train reached 250 kilometers per hour as it cut through Despeñaperros, and the ash remained intact, motionless, never falling.
This ornament served as the perfect metaphor for a Spain entering technological modernity hand in hand with the Expo and the Olympic Games, inaugurating a flagship product whose initial prestige was built on an obsessive commitment to punctuality, where a delay of more than five minutes triggered an automatic refund of the ticket price. Three decades later, the shock of Urda hurts in a familiar way and dispels that old mirage of infallibility.
The metal of Renfe and Iryo trains near Toledo resonates with the still-fresh echo of the Adamuz disaster, which occurred barely ten months ago. When national high speed fails twice in less than a year, traveler confidence fractures; boarding implies entrusting one’s own life to an invisible network of sensors, cables, and external decisions. The pain for the 69 victims coexists today with a perfectly understandable collective unease, a fear that grows when looking at the global map, where increasing military pressure on Europe’s eastern flank and instability to the south turn the fear of a cyberattack against our critical infrastructures into an urgent national security debate.
“When national high speed fails twice in less than a year, traveler confidence cracks”
Initial investigations into what happened in Toledo point to a sequence of technical failures combined with operational decisions taken under extreme pressure, though the ultimate causes remain undetermined. However, what happened in the Urda tragedy resembles the operations manual for a cyber intrusion.
Everything began with the fall of the LZB, the veteran automatic protection system. When the system failed, the automatics reacted correctly and conservatively, ordering the immediate stopping of the trains. The real danger emerged later in the degraded-service phase. Switching to manual driving, ground operators authorized the AVE to proceed while the Iryo convoy ahead remained stationary. An intelligent attacker pursues exactly that same goal: provoke a small fault or a buildup of false alerts to force the system to shut down the technology and shift the entire burden of decision-making to an overwhelmed operator.
The cyberattacks that have already tested European rail
The modern train is no longer “a block of metal”: it is a sophisticated computer server on wheels. The attack surface of the Spanish network is immense and runs through Adif’s control centers, telecommunications, the power supply, and commercial management applications. Rail cybersecurity requires distinguishing between enterprise IT, responsible for ticket sales, and operational technology, responsible for the physical processes of movement. International precedents show that assaults tend to pursue very diverse aims.
In January 2022, the Cyber Partisans group sabotaged Belarusian railways by encrypting their databases to inject friction into Russian military movements. In Denmark, an indirect attack against the test server of a software subcontractor paralysed numerous trains of the DSB operator for four hours in October 2022. More troubling was the Polish case in August 2023, where unauthorized radio emissions abused emergency frequencies and activated false automatic stopping orders on about twenty trains, taking advantage of messages lacking cryptographic authentication.
“Rail cybersecurity requires distinguishing between enterprise IT, responsible for ticket sales, and operational technology, responsible for the physical processes of movement”
These incursions show that espionage allows precisely knowing where to apply pressure. The analysis of state attackers compels the inclusion of two main profiles in Western defensive models. On one hand, Sandworm (identified as APT44 and linked to Russian military intelligence) has broad experience in the destructive sabotage of critical infrastructure and supply chains tied to warfare. On the other hand, Volt Typhoon, backed by China, operates under a long-term stealth infiltration logic, preparing stable access in transport, water, and energy networks to preserve the option of triggering massive disruptions during a later geopolitical crisis. The entry paths for these groups are usually spear-phishing emails, employee credential theft, or maintenance access exposed on the internet.
How is the Spanish railway network protected against cyberattacks?
Against this threat, the institutional reaction of the Spanish state and its allies is organized through a rigorous and coordinated protection architecture. Nationally, the CNPIC oversees critical infrastructures from the Ministry of the Interior, while the CCN-CERT and the INCIBE-CERT centralize the technical response to digital incidents to prevent an intrusion from propagating to circulation systems. At the European level, the NIS2 directive and the CER directive establish risk management and resilience obligations for affected operators, including those related to their suppliers. ENISA has produced recommendations to divide railway networks into security zones based on the criteria of CENELEC’s CLC/TS 50701 specification, with the aim of preventing an incident in administrative IT from spreading to speed-control systems. This resilience is tested under maximum pressure in multinational exercises such as Cyber Europe. Finally, NATO integrates this protection into its doctrine of collective defense, incorporating since September 2026 the redundancy of transportation IT systems to ensure mobility for both military and civilian needs in hybrid crises.
The true lesson that critical networks must draw from the Urda catastrophe lies in the need to dissociate security from performance. The flaw of the traditional model rests on trusting final safeguard to the lucidity of a human being in the seconds after a technological failure. The modernization of high-speed requires the implementation of systems such as ETCS Level 2, a radio-based architecture in which the train driver retains control of the movement, but an onboard protection computer acts as a digital guardrail that monitors speed and braking when it has the necessary information, without eliminating the risks inherent in degraded operation. Trust in high-speed is built by demonstrating that, when a component fails or an adversary tries to manipulate the environment, the system preserves independent resources to look after the lives of travelers, realistically assuming that faults or attacks are risk variables always present.
“The true lesson that critical networks must draw from the Urda catastrophe lies in the need to dissociate security from performance”
When the reader contemplates the uniform blue of railway maps or the regularity of commercial timetables, they tend to perceive the infrastructure as a static and purely mechanical system. The reality of contemporary railway engineering disproves this assumption by constituting a hybrid organism where software determines the viability of every physical movement on the tracks. The complexity of the Spanish system, characterized by a dense high-speed network connecting major urban hubs under extremely tight time constraints, magnifies the consequences of any minor misalignment. An artificially induced delay at a strategic node such as the Atocha gauge changer or the branching of the line in Andalusia can generate a cascading effect capable of paralysing traffic across wide areas of the national territory, turning a local incident into a mobility crisis of state-wide scale.
A systemic vulnerability of that magnitude requires examining the guts of technological contracts and the global supply chain that feeds national critical operators. Currently, the asset inventory of companies like Adif or Renfe jointly spans locomotives, catenaries, and mechanical switches, while incorporating thousands of programmable logic controllers supplied by transnational consortia. The formal diversity of these contracts often masks a dangerous underlying technological concentration, where multiple subcontractors and independent providers end up relying on a single common software platform or sharing remote access credentials for routine maintenance. An advanced state adversary tends to avoid the large operators’ robust perimeter defenses, instead opting to identify a weak link in a secondary IT services provider to propagate intrusion laterally into the operating subsystems responsible for signaling. The security of critical infrastructure, therefore, ceases to be the exclusive concern of the signaling engineers and becomes an ongoing audit of the software ecosystem operating in the sector’s margins.
The response of European institutions to this epochal shift reflects the transition from classical physical security to the strategic concept of integrated operational resilience. The implementation of the CENELEC technical specification CLC/TS 50701 represents the most ambitious effort to bring the rigor of industrial cybersecurity to the entire lifecycle of railway equipment, requiring risk assessments beyond the initial design phase to the final decommissioning of equipment. This specification assumes that a component’s reliability under wear does not guarantee resistance to deliberate human manipulation, requiring independent validations to certify that operator displays show unaltered data. Under this logic, international crisis-management drills like Cyber Europe 2026 take on a fundamental importance, contrasting regulatory protocols with critical decision-making under maximum psychological pressure, forcing state technicians to cooperate closely with private industry specialists and the intelligence services of the Atlantic Alliance.
Railway and collective trust: an infrastructure that sustains coexistence
This structural transformation returns the focus to the very essence of public transport as the foundation of the modern state. When analyzing the impact of rail on the development of our societies, historian Tony Judt explained that the train changed time, space, and also the way we coexist. Its introduction represented an evolution in the speed of locomotion, consolidating itself as the true catalyst that forged the nation’s psychology. Before railways, communities lived in isolated enclaves governed by scattered local times, a geographic atomization that the railway dissolved by unifying entire nations under a single legal time and a shared fate. That civilizational achievement forced citizens to experience for the first time collective synchronization, transforming travel into a democratic exercise where different social classes shared the same journey. Mutual trust and the harmonious coordination of movements became the new rules of urban coexistence.
“The response of European institutions to this epochal change reflects the transition from classic physical security to the concept of integrated operational resilience”
Today, that geography of collective trust has moved to the digital realm, and its vulnerability now depends as much on the wear of the tracks as on the integrity of data flows linking IT systems to people. Buying a high-speed ticket constitutes the utmost expression of that social pact described by Judt, a form of delegated faith where the citizen entrusts their safety to a technological lattice that assumes infallibility. The real danger of tragedies like those of Adamuz and Urda goes beyond the material failure of a LZB beacon or the confusion of an operator under pressure. The real risk lies in the breakdown of that shared certainty that makes communal life possible in our cities. Holding political accountability and clarifying the causes of the disaster is an indispensable democratic obligation, but the true challenge of our era is to understand that safeguarding these information circuits goes far beyond railway engineering, becoming the first line of defense of sovereignty and the coexistence of a free society.
