Eurail says December breach exposed data of 308,777 travelers
Summary
Eurail says attackers accessed its customer database in December 2025 and transferred files containing personal information of 308,777 people, including passport details, IBANs, health information and contact details.
Key points
- Eurail says an unauthorized actor accessed its customer database and transferred files on December 26, 2025.
- A filing with Oregon’s attorney general says the breach affected 308,777 individuals.
- The exposed information included names, passport and ID details, bank IBANs, health information, and contact details.
- Eurail said samples of the stolen data were posted on Telegram and offered for sale on the dark web.
- Eurail notified affected individuals in March 2026 and advised them to watch for phishing, update reused passwords, and monitor bank activity.
- The European Commission separately warned that additional sensitive information may have been exposed for some DiscoverEU travelers.
Article Details
- Victim Organization
- Eurail B.V.
- Incident Type
- Unauthorized access to the customer database and transfer of files containing personal data
- Incident Date
- 2025-12-26
- Data Types Exposed
- Names
- Passport numbers and details
- ID numbers
- Bank account IBANs
- Health information (the European Commission warned this may have been exposed for some DiscoverEU beneficiaries)
- Email addresses
- Phone numbers
- Affected Records
- 308,777 individuals
- Operational Impact
- Eurail notified affected customers and advised them to change passwords, watch for phishing and scams, and monitor bank accounts. No service disruption was reported.
- Ransom Or Extortion
- Eurail said threat actors published a sample of stolen data on Telegram and were attempting to sell it on the dark web. No ransom demand was reported.
- Claim Status
- confirmed