Eurail breach exposed travellers’ identity and passport details; stolen data offered for sale
A Eurail breach exposed some travellers’ identity, contact and passport details, including DiscoverEU participants. Stolen data was offered for sale. Check your notification, change your Rail Planner password and watch for impersonation scams.
Check your Eurail, Interrail or DiscoverEU notification for the information affected; contact [email protected] if you need clarification. Follow the company’s precautionary advice to change your Rail Planner password, and treat unexpected calls, emails or texts asking for personal information with caution. Monitor bank transactions and report anything unusual to your bank immediately.
What’s happening
Eurail disclosed a customer-data breach on 10 January 2026 involving pass holders, seat reservations and DiscoverEU participants. Its October FAQ confirms that affected records included names, birth dates, gender, passport or ID numbers and contact details, with the information varying between customers. SANS reported that the European Commission separately warned DiscoverEU travellers about possible exposure of identity-document copies, bank account references and health information. Eurail says it does not store bank or card details or passport images for ordinary pass purchases. On 13 February, it confirmed stolen data was offered for sale and a sample published on Telegram. By October, the company said it had secured its systems and notified affected customers where contact details were available, including those in the sample. As at 3 November, the reviewed notices give no overall affected-customer total; further misuse beyond the sale offer and sample publication is not established.
- What
- Breach
- Affects
- Eurail and Interrail travel passes, seat reservations and DiscoverEU
- Fixed in
- Nothing to patch
- Since
- 10 Jan 2026
- Closed
- 2 Oct 2026
Timeline
- Update
The updated FAQ said customers whose information appeared in the Telegram sample had been notified where contact details were available. The company also reported securing its systems with external specialists and strengthening security measures.
- Vendor revised
An updated company FAQ confirmed that affected information included names, birth dates, gender, passport or ID numbers and contact details, varying by customer. It said affected customers had been told which data was involved where contact details were available.
- Vendor revised
Eurail confirmed that copied customer data had been offered for sale on the dark web and a sample published on Telegram. It was still investigating which records and how many customers were involved.
- Update
Customers began receiving notification emails, according to SANS. DiscoverEU participants were separately warned of possible exposure of identity-document copies, bank account references and health information.
- Made publicNothing to patch
Eurail disclosed unauthorised access to customer data affecting pass holders and seat-reservation customers, including people booking through partners.
Sources
- Data security incident (updated release)Eurail · 13 Feb 2026
- What personal data may be involved?Interrail · 2 Oct 2026
- Has my data been misused?Interrail · 2 Oct 2026
- Do I need to take any action?Interrail · 2 Oct 2026
- NewsBites Volume XXVIII – Issue 04: Eurail Discloses Customer Data BreachSANS · 16 Jan 2026
- Eurail says stolen traveler data now up for sale on dark webBleepingComputer · 16 Feb 2026