CSIRT-CAN – Centro de Respuesta a Incidentes de Seguridad de Canarias

Blog Lists

Cyberattacks on Industrial Systems: When Digital Threats Cause Real-World Losses

 The incident affecting French supermarkets in October 2026 highlights the importance of securing connected systems and ensuring business operational continuity.Cybersecurity is no longer limited to protecting data, servers, and IT equipment. In an increasingly connected environment, systems that control physical processes can also become targets for cybercriminals, with consequences that extend far beyond the digital world.A Cyberattack with Operational and Financial ConsequencesOn October 11 and 12, 2026, several French supermarkets were affected by an incident that compromised their refrigeration systems. The manipulation of temperature controls led to food spoilage, property damage, and potentially significant financial losses.This case illustrates how a vulnerability in a connected system can directly affect business operations. Disruptions to an industrial process or essential piece of equipment can interrupt operations, generate financial losses, and threaten business continuity.Although the specific impact depends on each installation, the incident highlights a risk affecting many industries: the interconnection between IT systems and the physical systems on which business operations depend.Why Are Connected Systems Vulnerable?Industrial environments and Internet of Things (IoT) devices enable organizations to monitor and control equipment remotely, improve efficiency, and automate processes. However, they can also expand the attack surface when appropriate security measures are not in place.Key risks to assess include:Outdated systems: Devices running obsolete software or firmware that may contain known vulnerabilities.Insufficiently protected remote access: Administrative interfaces exposed to the internet or weak authentication mechanisms.Poor network segmentation: Connections between corporate networks and industrial systems that may facilitate the spread of an incident.Insufficient monitoring: A lack of alerts to identify unusual changes in critical parameters or unauthorized access.Protecting these environments requires security measures tailored to each organization's needs, taking into account not only cybersecurity but also the availability and safety of physical processes.The Four Pillars of an Effective Cybersecurity StrategyA robust strategy should address the entire incident management lifecycle, from risk reduction to operational recovery.1. Prevention: Reduce the Attack SurfacePrevention starts with asset identification, vulnerability assessments, and the implementation of appropriate security controls. Keeping systems up to date, restricting remote access, applying the principle of least privilege, and segmenting networks help reduce the likelihood of compromise.2. Detection: Identify Threats EarlyContinuous monitoring helps identify anomalous behavior, suspicious access, and unexpected changes across systems. In industrial environments, monitoring operational parameters is also essential to detect deviations that may indicate tampering or a malfunction.3. Response: Contain Incidents and Minimize Their ImpactAn incident response plan defines responsibilities, establishes procedures, and coordinates the actions required to contain a threat. Preparation is essential to reducing response times and preventing an incident from affecting additional systems or processes.4. Recovery: Restore Operations SafelyRecovery requires business continuity procedures, backups where applicable, and restoration plans tailored to the affected systems. Before bringing a compromised device back online, organizations must verify that appropriate security and operational conditions have been restored.Cyber Resilience as Part of Business ContinuityThe main lesson from this incident is that cybersecurity must be treated as an essential component of enterprise risk management.Protecting an organization means more than making attacks difficult. It also requires mechanisms to detect threats, respond in a coordinated manner, and restore operations with minimal disruption.Cyber resilience addresses this challenge through an integrated approach to security, aligned with operational requirements and business objectives.Is Your Organization Prepared to Face a Cyberattack?Assessing connected systems, identifying vulnerabilities, and reviewing incident response procedures are essential steps toward strengthening security and ensuring operational continuity.In an increasingly digital environment, organizations must be prepared to address threats that can compromise not only the confidentiality of information but also system availability, business operations, and customer trust.An effective cybersecurity strategy takes a comprehensive approach that enables organizations to anticipate risks, detect suspicious activity, and respond quickly to incidents. This includes keeping systems up to date, securing access, monitoring technological assets, and maintaining response and recovery procedures tailored to business needs.Business continuity planning also helps reduce the impact of disruptions and supports the safe, controlled restoration of operations.Prevention is essential, but the ability to respond and recover is equally important. Preparing an organization for a cyberattack means reducing risk, minimizing consequences, and strengthening resilience in an ever-evolving threat landscape.

Read more

Denmark Confirms Security Incident Affecting Personal Data of 8.8 Million People

Unauthorized access to Denmark’s national population register highlights the risks associated with the misuse of legitimate access and the need for stronger controls over sensitive personal information.Official announcement date: October 5, 2026Category: Cybersecurity · Data Protection · Risk ManagementA security incident puts personal data protection in the spotlightDanish authorities have confirmed a security incident involving the Central Person Register, known as the CPR, in which unauthorized parties gained access to names, addresses, and personal identification numbers associated with approximately 8.8 million registered individuals.The incident was announced on October 5, 2026, by Denmark’s Ministry of Higher Education and Science and Digitalization. According to the official statement, the affected records include current residents, people who have emigrated, and deceased individuals who remain registered in the system.The case highlights the challenges faced by organizations responsible for managing large volumes of sensitive information. It also raises a fundamental cybersecurity question: how can organizations ensure that legitimate access privileges are not misused?What happened?According to Danish authorities, the incident was identified after irregular activity was detected in the CPR system during September 2026.The CPR Administration became aware of suspicious activity on Friday, October 2. Over the following weekend, it discovered that unauthorized parties had obtained access to personal information associated with approximately 8.8 million registered individuals.One of the most significant aspects of the incident is the method described by the authorities. According to the official announcement, the individuals involved misused a Danish private company's legitimate access to the system to conduct unauthorized information searches.This distinction matters. The available information does not establish that the central CPR system itself was directly breached through a technical vulnerability. Instead, the authorities describe the misuse of an existing access channel, while the precise circumstances remain under investigation.What personal data was exposed?The information accessed includes:Names and surnames: basic identifying information.Postal addresses: details that could potentially facilitate targeted fraud or deceptive communications.CPR identification numbers: personal identifiers used in Denmark to link individuals to administrative records and services.Authorities stated that, based on their initial review, the incident did not expose the names and addresses of individuals registered with official name and address protection.The full scope of the incident was still being assessed at the time of the announcement. It is therefore important to distinguish information confirmed as exposed from any additional consequences that have not yet been established.How many people were affected?The reported figure is approximately 8.8 million registered individuals.The CPR system contains around 11 million registered individuals, including current residents, people who have moved abroad, and deceased individuals who remain in the register.Consequently, the 8.8 million figure should not be interpreted as the number of current Danish residents affected. It refers to the approximate number of registered individuals whose data was subject to the unauthorized access described by the authorities.What actions have the authorities taken?Following the discovery of the incident, the CPR Administration announced several containment and investigation measures.These included:Revoking the access involved: the private company's access associated with the incident was stopped.Notifying the data protection authority: the incident was reported to the Danish Data Protection Agency.Launching a police investigation: law enforcement began investigating in cooperation with the relevant authorities.Conducting a security review: a comprehensive review of the CPR system was announced to determine whether further safeguards are necessary.Introducing preventive measures: additional initiatives were launched to reduce the likelihood of similar incidents.At the time of the initial announcement, authorities stated that the investigation was at an early stage and that they could not publicly identify those responsible.The key issue: when legitimate access is misusedFrom a cybersecurity perspective, one of the most important aspects of this case is the misuse of legitimate access privileges.Public and private organizations often need to grant employees, suppliers, and external partners access to sensitive information to perform authorized tasks. The risk arises when those privileges are used outside their intended scope or exploited by individuals who are not authorized to perform particular searches.This incident illustrates why access controls alone are not enough. Organizations must also continuously verify that access is being used appropriately.Measures that can help reduce these risks include:Principle of least privilege: granting only the permissions necessary for each role.Access monitoring: recording who accesses information, what they query, and when.Anomaly detection: identifying unusual patterns, such as large-scale queries or activity inconsistent with normal account behavior.Third-party audits: regularly reviewing the access privileges of suppliers and business partners.Query limits: applying appropriate controls based on the volume and sensitivity of the requested data.Incident response procedures: establishing processes to suspend suspicious access, preserve evidence, and make required notifications.These measures cannot eliminate every risk, but they can improve prevention, detection, and response capabilities.What are the potential consequences of personal data exposure?The exposure of names, addresses, and identification numbers can facilitate several types of fraud, although a data exposure incident does not mean that all these activities have occurred.One major risk is targeted phishing. Criminals may use genuine personal information to create messages that appear to come from a government agency, financial institution, or familiar company.Identity fraud, deceptive phone calls, and other forms of social engineering are also potential concerns. The more accurate the available information, the more convincing a fraudulent communication may appear.The consequences of an incident therefore depend not only on the number of records involved, but also on the nature of the exposed information, the safeguards in place, and any subsequent use of the data.However, the initial Danish announcement did not confirm that large-scale fraud had occurred, that the data was being sold online, or that those responsible had published it on underground platforms. Potential risks should not be confused with proven consequences.What can organizations in other countries learn from this incident?Although the incident occurred in Denmark, the issues it raises are relevant to any organization managing large volumes of personal information.Governments, hospitals, insurers, financial institutions, and technology companies all rely on systems that allow multiple users and third-party providers to access information. Protecting these systems requires both technical safeguards and clear accountability procedures.This case raises several important questions:Are third-party access privileges reviewed regularly?Are there limits and alerts for unusual or large-scale data queries?Are operations involving sensitive information logged and reviewed?Are permissions revoked promptly when they are no longer needed?Are effective procedures in place to respond to suspected misuse?Security strategies must account not only for external attacks, but also for risks arising from accounts, permissions, and connections that were originally authorized.Recommendations for individualsAlthough organizations bear primary responsibility for securing their systems and managing access appropriately, individuals can also take preventive steps.Be cautious of unexpected calls, emails, and messages requesting passwords, verification codes, or confidential information.Remember that a message can be fraudulent even if it contains your real name, address, or other personal details. Knowledge of personal information does not prove that the person contacting you is authorized or trustworthy.If a communication seems suspicious, verify the sender through the organization's official channels rather than using telephone numbers or links supplied in the message itself.Conclusion: data protection requires continuous monitoringThe incident reported by Denmark demonstrates the importance of strictly controlling access to personal information. Security is not only about preventing unauthorized entry into systems; it also requires monitoring how granted privileges are used and detecting potential abuse.Further investigation is needed to establish the precise sequence of events and determine whether additional safeguards are required. In the meantime, the case provides an opportunity for other organizations to review their access controls, third-party oversight, and incident response procedures.Protecting personal data requires continuous monitoring, traceability, and shared accountability.In an increasingly digital world, the question is no longer simply who can access a database. It is also how that access is monitored and what safeguards exist to detect misuse before it reaches a larger scale.Sources and further readingOfficial statement — Danish Ministry of Higher Education and Science and DigitalizationPublished October 5, 2026.https://fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/Editorial note: The figures and circumstances described above are based on the cited official announcement. The investigation was ongoing at the time of publication. Any subsequent developments should be verified against official sources.

Read more

Cyberattack on Renfe and Adif

Renfe, Spain’s state-owned passenger rail operator, is investigating a cybersecurity incident reportedly linked to servers belonging to Adif, the public entity responsible for managing a large part of Spain’s railway infrastructure, which may have been previously compromised.The investigation points to possible access to limited user information, mainly names and email addresses. At this stage, there is no reported evidence of access to ID numbers, bank details or payment information.The incident, detected in recent days, has raised concerns about the security of the digital systems operated by both entities and the connections between their IT infrastructures. While the investigation continues to determine the exact scope of the incident, rail services continue to operate normally.The case also raises several questions that remain unanswered: what information may have been accessible, whether any data was actually extracted, how extensive the intrusion was and whether there could be any additional risks for affected users.What happened?According to information provided by Renfe, the origin of the incident appears to be linked to previously compromised Adif servers that maintained connections with Renfe systems.After detecting the incident, Renfe activated its incident-response protocols, isolated the affected environments and implemented additional security measures with the assistance of independent cybersecurity specialists.According to Renfe, the incident occurred following several weeks of continued attempts to attack its systems, which had been detected and blocked by its security mechanisms.What data may have been affected?This is one of the aspects that is still under investigation.According to information provided by Renfe, the attackers may have gained access to limited user information, mainly:Names.Email addresses.The company states that there is no evidence of access to bank details, financial information, payment methods, ID numbers or other particularly sensitive information.Renfe also says that, based on the information available so far, there is no conclusive evidence that the information has been publicly disclosed.Additional informationIn addition to the information officially provided by Renfe and Adif, additional information about the incident has emerged. Among the details reported are:The possible extraction of approximately 500 GB of information.The possible use of artificial intelligence tools during the attack.Additional information concerning the possible scope and volume of the affected data.These details should be treated with caution and should not be considered confirmed facts while the investigation remains ongoing.Why is this incident important?The case highlights one of the main challenges facing cybersecurity today: organizations do not operate in isolation.Renfe and Adif maintain connections and exchange information between different systems. When one of those systems is compromised, existing connections can become a relevant factor in determining the scope of an incident.This makes areas such as the following particularly important:Network segmentation.Access controls.System monitoring.Third-party and supplier security.Privilege management.Early detection of anomalous activity.Incident-response procedures.Personal data protection.What risks could users face?The possible access to names and email addresses does not mean that users have suffered a further attack, but this information could potentially be used in subsequent fraud or impersonation campaigns.Possible risks include:Phishing: messages appearing to come from Renfe that ask users to visit a website, confirm information or take some other action.Identity impersonation: using names and other available information to make fraudulent messages appear legitimate.Travel-related fraud: fake emails or SMS messages concerning tickets, cancellations, changes to journeys or refunds.Credential theft attempts: messages designed to obtain passwords or access codes.Payment-related fraud: fake requests for payments, refunds or banking information updates.What should users do?Although there is currently no reported evidence of access to bank details, ID numbers or payment information, the possible exposure of names and email addresses could increase the risk of receiving fraudulent messages or impersonation attempts.Users should exercise particular caution with messages claiming to come from Renfe, especially those relating to:Tickets.Refunds.Changes to journeys.Payments.Alleged service incidents.Requests to confirm personal information.It is advisable not to click on suspicious links or enter passwords or banking information through links received by email or SMS.If in doubt, the safest option is to access Renfe’s official website or app directly rather than using a link contained in a message.Investigation ongoingThe incident continues to be investigated by specialist teams and the relevant authorities. Renfe has its security protocols in place and continues to assess the scope of the intrusion.At this stage, the main unanswered questions are what information was actually accessible, what information may have been extracted and whether there are any additional risks for affected users.As the investigation progresses, further details about the attack and its final scope may become available.SourcesOfficial sourceRenfe - Official communication regarding the cybersecurity incidentOther sources consultedEL PAÍSRTVE / EFEEuropa PressInfobaeEl IndependienteLa RazónVozpópuli

Read more

ENISA Threat Landscape 2026: New Trends in Cybersecurity

The European Union Agency for Cybersecurity (ENISA) has published its new Threat Landscape 2026, an analysis of the main threats and trends shaping the current cybersecurity landscape.The report highlights an important evolution: organisations are increasingly dependent on digital infrastructures, cloud services, technology providers, third-party applications and connected systems. This growing interdependence is also expanding the attack surface and creating new opportunities for cybercriminals and other malicious actors.Key Findings from the ReportAmong the key findings highlighted by ENISA are:57% of the incidents analysed were ideologically motivated.Almost 30% of the incidents were financially motivated.Public administration remained the most targeted sector, accounting for 32% of the cases analysed.Phishing and the exploitation of vulnerabilities remain among the main entry points used by attackers.Cybercrime accounted for 36% of the events analysed.Hacktivism generated 4,709 claims targeting EU Member States, with more than 89% related to DDoS attacks.In operations attributed to state-nexus intrusion sets, intrusion operations accounted for 87%, followed by phishing campaigns at 12%.Artificial intelligence is increasingly playing a role in Foreign Information Manipulation and Interference (FIMI) operations.An Increasingly Expanding Attack SurfaceOne of the most important aspects highlighted by the report is that technological risk is no longer limited to the systems an organisation directly controls.A company may have well-protected internal systems and still be exposed through a supplier, a third-party application, a compromised account, an unpatched vulnerability or a technology dependency.This makes attack surface management one of the fundamental elements of a modern cybersecurity strategy.The question is no longer simply:What systems do we have and how do we protect them?We should also be asking:Which systems and suppliers do we depend on? What information do they handle? What would happen if one of them were compromised?Phishing Remains a Major ChallengeDespite increasingly advanced security technologies, the human factor remains highly relevant.Phishing attacks attempt to obtain credentials, sensitive information or initial access to an organisation through social engineering techniques.For this reason, security cannot rely exclusively on technical tools. A combination of security awareness, training, multi-factor authentication, access controls, monitoring and incident response capabilities is essential.Vulnerabilities: The Importance of Reducing ExposureAnother important element highlighted by ENISA is the exploitation of vulnerabilities.A known vulnerability can become an entry point when an organisation lacks the appropriate mechanisms to identify its assets, assess its exposure and apply the necessary security updates.An effective vulnerability management programme should therefore begin with something that may seem simple, but is fundamental:knowing what assets we have, where they are and what software they are running.Without this visibility, it becomes much more difficult to properly prioritise risk.DDoS Attacks and HacktivismThe report also highlights the significant level of activity associated with hacktivism.DDoS (Distributed Denial-of-Service) attacks primarily aim to affect the availability of a service by generating large amounts of traffic or requests.Although a DDoS attack does not necessarily mean that an attacker has gained access to an organisation's internal systems, it can cause service disruptions, affect an organisation's reputation and generate operational costs.For this reason, availability should be considered an essential part of an overall security strategy, alongside confidentiality and integrity.Artificial Intelligence Introduces a New DimensionAI is transforming virtually every area of technology, and cybersecurity is no exception.In addition to being used to improve defensive capabilities, ENISA highlights the use of AI in Foreign Information Manipulation and Interference (FIMI) operations.This creates an environment in which certain campaigns can potentially become faster, more scalable and more sophisticated.For organisations, this means that security strategies should consider not only traditional attacks against IT systems, but also risks related to information, digital identity and trust.What Should Organisations Do?The threat landscape described by ENISA reinforces the need to adopt a risk-based approach to cybersecurity.Some fundamental measures include:Maintain an up-to-date inventory of assets and systems.Identify critical dependencies and technology providers.Manage and prioritise vulnerabilities.Strengthen protection against phishing and social engineering.Implement multi-factor authentication and apply the principle of least privilege.Monitor systems to detect anomalous behaviour.Maintain incident response and recovery plans.Perform regular backups and periodically test recovery procedures.Assess the risks associated with the use of artificial intelligence.Continuously train and raise security awareness among users.ConclusionThe ENISA Threat Landscape 2026 demonstrates that the threat landscape continues to evolve alongside our growing dependence on technology.Security is no longer simply about installing antivirus software, configuring a firewall or keeping systems up to date.The real challenge is understanding which assets we have, what we depend on, which threats may affect us and how we would respond if an incident occurred.Cybersecurity should be approached as a continuous process of prevention, detection, response and improvement.For any organisation, understanding the current threat landscape can be an important first step towards reviewing its cybersecurity strategy and identifying where its greatest risks actually lie.Official Source and DocumentationThis article is based on the ENISA Threat Landscape 2026, published by the European Union Agency for Cybersecurity (ENISA) on 22 September 2026.The report analyses the evolution of the cybersecurity threat landscape in the European Union and the incidents observed during 2025.👉 Read the official report: ENISA Threat Landscape 2026👉 Explore the ENISA Threat Landscape: ENISA Threat LandscapeThe statistics and findings cited in this article are based on ENISA's published report. The interpretations and recommendations included in this article are provided as an informative analysis of ENISA's published material.

Read more

Cyberattacks | WORMS

Computer Worms: What Are They and How Can We Protect Ourselves?Computer worms are a type of malware that can copy themselves and spread automatically from one computer to another. Like a real worm, they can move from one device to another and reproduce.What can they cause?A computer worm can:Slow down devices by consuming system resources.Spread through a network and infect other devices.Steal, modify or damage information.Cause interruptions to services and networks.How does a computer worm work?Its operation can be summarized in five steps:It enters: it takes advantage of a vulnerability in the system or network to infect a device.It copies itself: it creates copies of itself on the infected device.It spreads: it searches for other connected devices and sends itself automatically.It infects: it can install itself on new devices without the user having to run it.It causes an impact: it consumes system resources and can cause problems on devices and networks.How can we protect ourselves?To reduce the risk from computer worms:Keep your operating system and software up to date.Use an updated antivirus.Activate your firewall.Do not open suspicious emails, links or files.Avoid connecting to unknown or insecure Wi-Fi networks.Make backup copies of important files.A real example: the Morris WormThe Morris Worm was a malicious program created by Robert Tappan Morris that spread automatically among computers connected to the Internet.It was launched on November 2, 1988, and affected approximately 4,000 computers, causing system slowdowns and crashes. The incident demonstrated the potential impact of this type of threat and contributed to the development of measures for responding to computer security incidents.Did you know?Computer worms can spread across a network without the user having to do anything, taking advantage of security vulnerabilities to move from one device to another.They can also spread through email or shared files and may use social engineering techniques to persuade people to open attractive-looking files or messages.

Read more

What do we do for you?

CSIRT-CAN offers various services for the prevention and prompt resolution of cybersecurity-related incidents.

Tarjeta de Links

Information is  PREVENTION

Incident REPORTING

Proactivity and TRAINING

Happening Now

Trends

Slider Principal

Be Careful What You Search on Google!

Read more

Vulnerability Allowing Remote Code…

Read more

[SCI] Command Injection in Moxa Products

Read more

Multiple Vulnerabilities in Power…

Read more

Services by Profiles

Públicos Objetivo

What is CSIRT-CAN?

The CSIRT-CAN (Canary Islands Security Incident Response Center) is an entity dedicated to the protection and resilience of digital infrastructures in the Canary Islands. Our center specializes in the detection, analysis, and mitigation of cybersecurity incidents, providing technical and strategic support to public and private organizations.

Report an incident
CAPTCHA
Image CAPTCHA
Get new captcha!
Enter the characters shown in the image.
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.