Eurail Data Breach Affects 300,000 Users in December
Data Breach Exposes Sensitive Information of Over 300,000 Eurail Customers
A recent cyberattack has compromised the personal information of over 300,000 individuals who purchased digital passes for train travel across Europe through Eurail B.V.
Sensitive Information Compromised
The breach occurred in December 2025 when an unauthorized actor accessed the firm’s customer database, obtaining:
- Full names
- Passport details
- Identification numbers
- Bank account International Bank Account Numbers (IBANs)
- Health information
- Contact details
Risks Associated with the Breach
The compromised data includes addresses and phone numbers, which could potentially be used for targeted phishing attacks or scams.
Eurail has advised affected customers to remain vigilant and update their passwords on any platforms where they are reused. Additionally, the company recommends monitoring bank account activity and reporting any suspicious transactions to the bank promptly.
Notification and Response
The breach was first disclosed in February 2026, when Eurail notified the affected individuals that their personal information had been compromised.
The company stated that it did not store financial information or passport photocopies on the breached systems, but the European Commission warned that the exposed data, including health information, may have been compromised for young travelers who received a Pass through the DiscoverEU program.
European Commission Warning
The European Commission’s warning regarding the exposure of health information for young travelers highlights the importance of robust security protocols and timely notifications in the event of a data breach.
Related News
In related news, the European Commission has also confirmed a data breach after the Europa.eu web platform was hacked in a cyberattack claimed by the ShinyHunters extortion gang.
The incident serves as a reminder of the ongoing threats to sensitive information and the need for vigilance in protecting personal data.