Was It Breached Secria

Recent breaches

Eurail data breach: what leaked, and what to do

Eurail B.V., which sells Eurail and Interrail passes, says files were taken from its network on 26 December 2025. Its US letter lists name and passport number.1,2

Eurail B.V.
c/o Cyberscout

March 27, 2026

Notice of Data Breach

... The evidence showed that an unauthorized actor transferred files from our network on December 26, 2025. ...

What Information Was Involved? The information included your name and passport number.

... never share your information with someone who contacts you unsolicited or who claims to work for Eurail.

... please call 1-833-319-9486, Monday through Friday ...

  1. The senderThe letter comes back to Cyberscout, in Suwanee, Georgia, on Eurail's behalf.1
  2. Two data types in the US letterWashington's filing also lists full date of birth.1,3
  3. No monitoring offerThe letter offers no free credit monitoring. It asks you to stay alert to messages instead.1
  4. The questions line8:00 a.m. to 8:00 p.m. Eastern, weekdays, as printed in the filed sample.1

Drawn from the sample letter Eurail filed with California's attorney general. Checked 4 November 2026 against the sources.

The facts, as filed

"The company says" marks Eurail's own account. A listing here isn't a finding that the company was at fault.

Who it is
Eurail B.V. is based in Utrecht, the Netherlands. It sells Eurail and Interrail rail passes and runs the Rail Planner app.1,2
What happened
The company says it found unusual activity on part of its network, and that an unauthorized actor transferred files on 26 December 2025. On 25 February 2026 it found that the files held people's information.1 Its California filing gives the breach dates as 24 December 2025 to 8 January 2026.1
People affected
Eurail's notice gives no total, and we found none in a government record we could read as of 4 November 2026. Washington's list counts 1,988 Washingtonians, reported 27 March 2026.2,3
What leaked
The company says the data may include order and reservation details, basic identity and contact details, travel companions, and, where provided, passport number, country of issue and expiry date.2
What did not
For passes bought from Eurail, the company says it doesn't store bank or credit card information or keep a visual copy of your passport.2
On the dark web
On 13 February 2026 the company said some of the data had been offered for sale on the dark web, and a sample published on Telegram.2
Lawsuit
As of 4 November 2026 we found no court-approved settlement, and no filed lawsuit we could read in a court record. Law firms advertise investigations only.

From a December holiday to letters in March

The dates come from Eurail's letter, its notice and the European Commission.

  1. Files are transferred from Eurail's network, the company says.1

  2. Eurail posts its first public notice.2

  3. The Commission warns DiscoverEU travellers.4

  4. Eurail says data was offered for sale.2

  5. US letters, and filings in California and Washington.1,3

If your pass came through DiscoverEU

DiscoverEU is a European Commission action financed under Erasmus+, and Eurail is its supplier. The Commission lists more data than Eurail's own notice does.4

What the Commission says may be involved

Where you provided it: name, date of birth or age, passport or ID information or photocopies, email and postal address, country of residence, phone number, bank account reference (IBAN) and data concerning health.4

Who to contact

The Commission's education directorate, DG EAC, is the main contact point for DiscoverEU travellers. Eurail has contacted potentially affected participants on the Commission's behalf.4

What to do if you got a Eurail letter or email

The steps come from Eurail, the European Commission and the letter itself. The full checklist covers every data type.

  1. Be careful with messages about Eurail or your trip.Eurail says it will never ask for sensitive information through unsolicited contact, by phone, email or text.2
  2. Change your Rail Planner app password.Eurail also suggests changing passwords linked to your email, social media and banking accounts.2,4
  3. Watch your bank account.Report any unusual transaction to your bank straight away.2,4
  4. In the US: consider a credit freeze.The letter explains that a freeze is free to place and lift, and must be placed at each of the three credit bureaus separately.1
  5. In the EU: report misuse to your data protection authority.The Commission suggests this if you think your data is being used maliciously.4

Questions people ask

Is the Eurail data breach letter or email real?

The sample Eurail filed in California returns to Eurail B.V. c/o Cyberscout, P.O. Box 3826, Suwanee, GA 30024, and gives 1-833-319-9486 for questions.1 Eurail's notice gives privacyhelp@eurail.com.2 Compare yours with them, and with our letter check.

Do I need to replace my passport?

Neither Eurail's notice nor the Commission's statement tells people to replace a passport. Eurail says passport number, country of issue and expiry date may be involved, but it doesn't keep a visual copy of your passport for passes it sold.2,4 If you're unsure, ask the authority that issued it.

Is there compensation for the Eurail data breach?

We found no court-approved settlement as of 4 November 2026. A real claim process comes with a court-approved notice that names the case. This isn't legal advice.

Was Interrail hacked too?

Yes, in the sense that Interrail passes come from the same company, Eurail B.V. Its notice is published on interrail.com.2

Sources 4
  1. Eurail B.V.: filing and sample notice (reported 27 March 2026), California Attorney General. Read 4 November 2026.
  2. Data security incident (updated release, 13 February 2026), Eurail B.V. Read 4 November 2026.
  3. Data Breach Notifications, Washington State Office of the Attorney General. Eurail B.V., reported 27 March 2026. Read 4 November 2026.
  4. Updated: Data Security Incident affecting DiscoverEU travellers (last updated 13 January 2026), European Youth Portal, European Commission. Read 4 November 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check