Eurail's Stolen Traveler Data Sold on Dark Web to Hackers

Eurail B.V., a Netherlands-based firm managing and selling passes for train travel across Europe, suffered a data breach in January 2026 when threat actors gained unauthorized access to its customer database. The compromised sensitive information includes full names, passport details, ID numbers, bank account IBANs, health information, and contact details (email addresses, phone numbers), affecting an unknown number of customers. A sample of the stolen data was published on Telegram by a separate entity, while Eurail's own data has been offered for sale on the dark web. The company is currently investigating which specific records were compromised and will send individual notifications to affected customers. Concerned authorities have also been notified in accordance with GDPR requirements, prompting customers to be vigilant to potential phishing attempts and update their account passwords accordingly.