Stolen Eurail Customer Data Now Listed for Sale on Dark Web
Rail pass operator confirms breach data is circulating online as investigation continues.
Eurail B.V. has confirmed that data stolen in a recent cyberattack is now being offered for sale on the dark web. The threat actor has also published a sample dataset on Telegram, increasing concerns about potential misuse.
The Netherlands-based company manages Eurail and Interrail passes, providing access to approximately 250,000 kilometers of European railways. Its services are widely used by international travelers and participants in the EU’s DiscoverEU program.
What Was Previously Disclosed
Last month, Eurail revealed that attackers gained unauthorized access to its customer database. The breach exposed highly sensitive information, including:
- Full names
- Passport and ID numbers
- IBAN bank account details
- Health-related information
- Email addresses and phone numbers
At the time, the company began investigating the scope and impact.
Dark Web Exposure Confirmed
In its latest update, Eurail stated that stolen data is now being actively marketed on underground forums. A partial dataset has already appeared publicly.
The company is still working to determine:
- The exact type of records exposed
- The total number of affected customers
Individual notifications will be sent once verification is complete.
Regulatory Reporting Underway
Eurail confirmed it has notified relevant data protection authorities under General Data Protection Regulation requirements. Authorities outside the European Union are also expected to receive alerts.
What Customers Should Do
Given the nature of the exposed information, customers face elevated risks of phishing, identity fraud, and financial scams.
Eurail advises customers to:
- Reset passwords for their Rail Planner app
- Change passwords on other platforms where the same credentials were used
- Monitor bank accounts closely for suspicious transactions
- Report unusual financial activity immediately
The company has published a FAQ page and opened a dedicated support channel for affected individuals.
Strategic Implication
Travel and ticketing platforms hold verified identity and payment information, making them high-value targets for data brokers and fraud networks.
When passport details and IBAN numbers circulate online, criminals can craft highly convincing social engineering campaigns.
This incident underscores a broader trend: customer databases linked to mobility, hospitality, and travel continue to attract threat actors seeking monetizable personal data.