{"id":"eurail-traveller-data-breach-jan-2026","category":"breach","status":"closed","title":"Eurail breach exposed travellers’ identity and passport details; stolen data offered for sale","tldr":"A Eurail breach exposed some travellers’ identity, contact and passport details, including DiscoverEU participants. Stolen data was offered for sale. Check your notification, change your Rail Planner password and watch for impersonation scams.","summary":"Eurail disclosed a customer-data breach on 10 January 2026 involving pass holders, seat reservations and DiscoverEU participants. Its October FAQ confirms that affected records included names, birth dates, gender, passport or ID numbers and contact details, with the information varying between customers. SANS reported that the European Commission separately warned DiscoverEU travellers about possible exposure of identity-document copies, bank account references and health information. Eurail says it does not store bank or card details or passport images for ordinary pass purchases. On 13 February, it confirmed stolen data was offered for sale and a sample published on Telegram. By October, the company said it had secured its systems and notified affected customers where contact details were available, including those in the sample. As at 3 November, the reviewed notices give no overall affected-customer total; further misuse beyond the sale offer and sample publication is not established.","action":"Check your Eurail, Interrail or DiscoverEU notification for the information affected; contact privacyhelp@eurail.com if you need clarification. Follow the company’s precautionary advice to change your Rail Planner password, and treat unexpected calls, emails or texts asking for personal information with caution. Monitor bank transactions and report anything unusual to your bank immediately.","product":"Eurail and Interrail travel passes, seat reservations and DiscoverEU","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["eurail","interrail","discovereu","data-breach","passport","travel"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Data security incident (updated release)","url":"https://www.interrail.com/en/ni/data-security-incident","by":"Eurail","date":"2026-02-13"},{"kind":"advisory","title":"What personal data may be involved?","url":"https://help.interrail.com/hc/en-001/articles/33123794076829-What-personal-data-may-be-involved","by":"Interrail","date":"2026-10-02"},{"kind":"advisory","title":"Has my data been misused?","url":"https://help.interrail.com/hc/en-001/articles/33099617968413-Has-my-data-been-misused","by":"Interrail","date":"2026-10-02"},{"kind":"advisory","title":"Do I need to take any action?","url":"https://help.interrail.com/hc/en-001/articles/33123849412893-Do-I-need-to-take-any-action","by":"Interrail","date":"2026-10-02"},{"kind":"news","title":"NewsBites Volume XXVIII – Issue 04: Eurail Discloses Customer Data Breach","url":"https://www.sans.org/newsletters/newsbites/xxviii-04","by":"SANS","date":"2026-01-16"},{"kind":"news","title":"Eurail says stolen traveler data now up for sale on dark web","url":"https://www.bleepingcomputer.com/news/security/eurail-says-stolen-traveler-data-now-up-for-sale-on-dark-web/","by":"BleepingComputer","date":"2026-02-16"}],"started":"2026-01-10","closed":"2026-10-02","created":"2026-11-03T20:57:33.185Z","updated":"2026-11-03T20:57:33.185Z","cve_notes":[],"timeline":[{"at":"2026-10-02","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"The updated FAQ said customers whose information appeared in the Telegram sample had been notified where contact details were available. The company also reported securing its systems with external specialists and strengthening security measures.","url":"https://help.interrail.com/hc/en-001/articles/33099617968413-Has-my-data-been-misused","by":"Interrail","patch":null},{"at":"2026-10-02","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"An updated company FAQ confirmed that affected information included names, birth dates, gender, passport or ID numbers and contact details, varying by customer. It said affected customers had been told which data was involved where contact details were available.","url":"https://help.interrail.com/hc/en-001/articles/33123794076829-What-personal-data-may-be-involved","by":"Interrail","patch":null},{"at":"2026-02-13","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"Eurail confirmed that copied customer data had been offered for sale on the dark web and a sample published on Telegram. It was still investigating which records and how many customers were involved.","url":"https://www.interrail.com/en/ni/data-security-incident","by":"Eurail","patch":null},{"at":"2026-01-13","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Customers began receiving notification emails, according to SANS. DiscoverEU participants were separately warned of possible exposure of identity-document copies, bank account references and health information.","url":"https://www.sans.org/newsletters/newsbites/xxviii-04","by":"SANS","patch":null},{"at":"2026-01-10","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Eurail disclosed unauthorised access to customer data affecting pass holders and seat-reservation customers, including people booking through partners.","url":"https://www.sans.org/newsletters/newsbites/xxviii-04","by":"SANS","patch":"na"}],"url":"https://hard.fyi/live/eurail-traveller-data-breach-jan-2026/","json":"https://hard.fyi/api/live?id=eurail-traveller-data-breach-jan-2026"}