Loading story…
Eurail B.V. confirmed that customer data stolen in a previously disclosed breach is now being offered for sale on the dark web, with a sample dataset published on Telegram. The Netherlands-based rail pass operator (Eurail/Interrail), which also serves travelers in the European Commission’s DiscoverEU program, said it is still investigating the scope and impact and has engaged external cybersecurity and legal experts while working to determine which records and how many customers are affected.
Reportedly exposed data may include order and reservation details and sensitive personal information such as names, dates of birth/age, contact details (email, phone, address, country of residence), travel companion information, and in some cases passport/ID data (including photocopies), passport numbers and expiry dates, bank account references (IBAN), and health-related data. Eurail said it has notified relevant data protection authorities under GDPR and plans to issue individual notifications to impacted customers; it also advised users to be alert for phishing/scams and to update passwords (including the Rail Planner app) where credentials may have been reused.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
In disclosures reported on April 8, 2026, Eurail said hackers breached its systems on December 26 and copied data affecting 308,777 people. The notices said names and passport numbers were stolen, and that the impact also extended to the DiscoverEU travel program.
On 2026-02-25, Eurail determined that files exfiltrated during the December 26, 2025 breach contained personal information. This internal assessment preceded the later customer notifications and public disclosure of the 308,777 affected individuals.
Eurail advised customers to watch for phishing and social engineering, change Rail Planner app passwords and any reused passwords, and monitor bank accounts for suspicious activity. It also published support information, including a FAQ and a contact channel for affected users.
Following confirmation that the stolen data was being sold, Eurail said it had secured its systems, engaged external cybersecurity and legal experts, and notified relevant data protection authorities under GDPR, with plans to alert authorities outside the EU. The company also said it would continue investigating the scope of the breach and notify affected customers directly where possible.
By mid-February 2026, Eurail confirmed that data stolen in the earlier breach was being offered for sale on the dark web, and that a sample of the data had been published on Telegram. Reports said the exposed information could include sensitive records such as identity details, passport data, IBANs, health information, and travel-related data.
In mid-January 2026, Eurail disclosed that attackers had gained unauthorized access to systems holding customer data. The company said personal, order, travel reservation, contact, and passport-related information may have been compromised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
reclaimthenet.org
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcedatabreaches.net
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Eurail (Interrail in the EU)** confirmed a data breach in which customer information was stolen, with affected customers notified via email after the company initially posted a notice about the incident. Reported exposed data includes **names, dates of birth, gender, email addresses, home addresses, phone numbers, and passport details** (number, issuing country, and expiration date). Eurail stated that it is monitoring for misuse and warned customers about downstream risks such as **phishing, spoofing, unauthorized account access, and identity theft**, and it set up customer support/FAQ guidance. For travelers who obtained passes via the EU’s **DiscoverEU** program, the European Commission issued a separate notice indicating potentially broader exposure beyond Eurail’s standard dataset, including **ID document copies, bank account reference details (e.g., IBAN/bank reference numbers), and health data**. Eurail indicated that customers who purchased directly did not have visual copies of passports stored, but DiscoverEU participants may have had such copies processed/stored as part of program requirements, increasing the sensitivity of the compromised data set.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026
Carnival Corporation disclosed a data breach after a threat actor used social engineering to compromise an employee account and gain unauthorized access to a limited portion of the company’s internal IT systems. The company said it detected suspicious activity on April 14, contained the intrusion with help from third-party cybersecurity specialists, and confirmed by April 22 that customer personal information had been copied from affected systems. The exposed data included names, addresses and other contact details, dates of birth, government-issued identification numbers linked to passports and driver’s licenses, and in some cases Social Security numbers. Reports said about **6 million** people in the United States may be affected. Carnival began notifying impacted individuals on May 27, issued a public notice for people it could not contact directly, and is offering **24 months** of complimentary credit monitoring through **TransUnion MyTrueIdentity**. The company has not identified the threat actor or said whether ransomware or extortion was involved.
Jun 29, 2026