Breaches and incidentsBriefReported by a reputable outlet, citing the company
Eurail (Interrail): 308,777 travellers’ identity and passport data stolen, then sold
Eurail disclosed in mid-January that identity, contact and passport information was compromised after hackers breached its systems on 26 Dec 2025.
- Disclosed
What happened
- Eurail disclosed in mid-January that identity, contact and passport information was compromised after hackers breached its systems on 26 Dec 2025; US state filings (April 2026) give 308,777 people. For the EU’s DiscoverEU programme, the European Commission warned ID photocopies, bank account numbers and some health data were likely included. Eurail confirmed data was offered for sale on the dark web and a sample posted on Telegram.
- Root cause: not disclosed. A hacker claims 1.3 TB including source code, database backups and Zendesk tickets (unverified).
- Unnamed hacker.
- Notified EU DPAs and US state regulators (Oregon, Texas, California).
Sources
- https://www.helpnetsecurity.com/2026/01/15/eurail-interrail-data-breach/
- https://therecord.media/eurail-reports-data-breach-impacting-over-300000
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.