Eurail Data Breach - Over 300,000 Passport Numbers Exposed

What Happened

In December, Eurail B.V., a European train travel company, experienced a significant data breach affecting 308,777 individuals. The breach was reported to U.S. regulators this week, revealing that hackers accessed sensitive information, including passport numbers. The incident occurred on December 26, and the company has since filed breach notices in various states.

Who's Affected

The breach primarily impacts travelers who used Eurail's services, particularly those from the U.S. The company has begun notifying affected individuals, especially in states like Oregon, Texas, and California. Those whose personal data was compromised are being informed directly, where possible.

What Data Was Exposed

The stolen data includes:

• Names
• Passport numbers
• Additional personal information such as bank account details and health data from a related program, DiscoverEU. The hacker claimed to have stolen 1.3 TB of data, which also included source code and database backups.

What You Should Do

Eurail has advised customers to be cautious of unsolicited communications asking for personal information. It is recommended that affected individuals:

• Change passwords associated with their Rail Planner app.
• Monitor their accounts for any suspicious activity.
• Remain vigilant against phishing attempts, as their information may be exploited.

The company has reported the breach to European Union data protection authorities and is taking steps to mitigate the impact on its customers. The hacker, who claimed responsibility for the breach, stated that the data has been offered for sale on the dark web, further emphasizing the seriousness of this incident.