Eurail Data Breach Exposed Personal Information of About 308,777 U.S. Individuals
Summary
Eurail reported unauthorized network access on Dec. 26, 2025, exposing names and passport numbers of about 308,777 U.S. individuals. Earlier dark-web and Telegram reports described additional data, while the full scope remains under investigation.
Key points
- Eurail says an unauthorized actor accessed its network and transferred files on Dec. 26, 2025.
- The company determined on Feb. 25, 2026, that the files contained personal information; about 308,777 U.S. individuals, including 242 New Hampshire residents, were affected.
- Eurail confirmed names and passport numbers were involved.
- Earlier disclosures linked to the incident reportedly included IBANs, email addresses, phone numbers, and health information; the article does not establish these as confirmed data for the U.S. individuals.
- Customers who bought passes through partner channels and DiscoverEU participants may also have been affected.
- Eurail engaged cybersecurity experts, notified law enforcement and state authorities, and says it terminated unauthorized access and strengthened security measures. The investigation continues.
- Eurail advised affected individuals to watch for suspicious communications and monitor financial accounts and credit reports.
Article Details
- Victim Organization
- Eurail B.V.
- Incident Type
- Unauthorized network access and transfer of files containing personal information
- Incident Date
- 2025-12-26
- Disclosure Date
- 2026-03-27
- Data Types Exposed
- Names
- Passport numbers
- IBANs (reportedly)
- Email addresses (reportedly)
- Phone numbers (reportedly)
- Health information (reportedly)
- Passport copies (may have been exposed, according to a DiscoverEU warning)
- Affected Records
- Approximately 308,777 U.S. individuals; the article also reports 242 affected New Hampshire residents.
- Operational Impact
- Files were transferred from Eurail's network. Eurail terminated unauthorized access, activated incident response, engaged cybersecurity experts, and is continuing its investigation. No service disruption is reported.
- Ransom Or Extortion
- The article says data from a prior breach was offered for sale on the dark web, with samples appearing on Telegram; it does not report a ransom demand.
- Claim Status
- confirmed