The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
A criminal group used artificial intelligence to identify vulnerabilities and hack the websites of Spanish railway operators Adif and Renfe, stealing approximately 500GB of sensitive data. The AI system played a central role in facilitating the prolonged cyberattack, raising concerns about AI-enabled threats to critical infrastructure in Spain.[AI generated]
Why's our monitor labelling this an incident or hazard?
The event explicitly mentions the use of an AI system by criminals to perform a cyberattack, including vulnerability scanning and unauthorized access, resulting in the theft of a large volume of data. This is a direct harm caused by the AI system's use in malicious activity, fulfilling the criteria for an AI Incident due to violation of data security and potential breach of privacy rights. The harm is realized, not just potential, and the AI system's role is pivotal in the incident.[AI generated]