The present paper focuses on the study of mortar samples where expansions with thaumasite formation occur as a consequence of sulphate attack. The samples correspond to a masonry mortar used in a rural construction located in the Spanish province of Toledo made of cement with limestone filler addition CEM II/AL. Composition and microstructure of the mortars have been analysed by means of scanning electron microscopy (SEM) using secondary and backscattered electrons (BSE) and X-ray diffraction (XRD). The results show that aggregates are contaminated with gypsum, which is the source of the sulphates for the internal attack. It seems that thaumasite is formed through an ettringite transformation where aluminium atoms are replaced with silicon atoms by means of a solid solution. The study highlights that thaumasite can be formed in warm weather through an internal sulphate attack due to gypsum contamination of aggregates.