Eurail Data Breach Affected 308,777 People, Exposing Names and Passport Numbers
Summary
Eurail's US breach notifications say 308,777 people were affected and names and passport numbers were stolen. The company confirmed a hacker offered data and posted a sample; the hacker's claim of stealing 1.3 TB remains attributed.
Key points
- Eurail's filing with Oregon authorities says the breach affected 308,777 people.
- Names and passport numbers were among the stolen information; Eurail said it does not store bank or credit card details or visual passport copies.
- The company said the hacker offered stolen data on the dark web and posted a sample dataset on Telegram.
- The hacker claimed to have taken about 1.3 TB from Eurail's AWS S3, Zendesk, and GitLab instances, including source code, support tickets, and database backups.
- Eurail is sending written notifications to potentially affected individuals.
Article Details
- Victim Organization
- Eurail
- Incident Type
- Data breach involving a network intrusion and theft of files containing personal information.
- Data Types Exposed
- Basic identity information
- Contact information
- Names
- Passport numbers
- Affected Records
- 308,777 people, according to Eurail's filing with the Oregon Attorney General. A hacker separately claimed to have stolen information belonging to millions of Eurail/Interrail customers.
- Affected Data Size
- A hacker claimed to have stolen roughly 1.3 terabytes of data; this amount was not confirmed by Eurail in the article.
- Operational Impact
- None reported.
- Ransom Or Extortion
- A hacker claimed negotiations with Eurail had failed. No ransom demand or payment was reported.
- Claim Status
- confirmed