Eurail Data Breach Exposes 300,000 Travellers, Prompts Passport Cancellations
AI-generated from multiple sources. Verify before acting on this reporting.
LONDON (AP) — Personal data belonging to more than 300,000 European rail travellers has been exposed following a security incident at Eurail, prompting some individuals to cancel their passports to prevent identity fraud. The breach, which was discovered in December, involved the sale of sensitive information on the dark web and its subsequent publication on messaging platforms.
Eurail, the company that operates the Interrail pass system, confirmed the incident on Wednesday. The compromised data includes names, dates of birth, and passport details for customers who purchased travel passes. The information was first offered for sale on dark web marketplaces before being made publicly available on Telegram channels.
The scale of the breach has triggered immediate action from affected travellers. Several individuals have contacted their national passport offices to cancel their current documents and request replacements, fearing that the exposed passport numbers could be used for fraudulent travel or identity theft. Security experts warn that the combination of personal identifiers and passport details creates a significant risk for financial fraud and unauthorized travel.
The security incident occurred in December, but the full extent of the data exposure was not immediately apparent. The company stated that it is working with cybersecurity firms to assess the damage and notify affected customers. No financial data, such as credit card numbers, was reported as part of the breach, but the exposure of passport information remains a critical vulnerability.
European data protection authorities have launched investigations into the incident. The breach falls under the jurisdiction of multiple countries, as the affected travellers are citizens of various European nations. Authorities are examining whether Eurail complied with data protection regulations and whether the company took appropriate measures to secure the information.
The incident highlights the growing risks associated with digital travel systems. As more services move online, the potential for data breaches increases, putting millions of travellers at risk. The exposure of passport details is particularly concerning, as these documents are essential for international travel and can be difficult to replace quickly.
Eurail has not yet provided a timeline for when all affected customers will be notified. The company is expected to issue a formal statement outlining the steps it is taking to prevent future incidents. In the meantime, affected travellers are advised to monitor their financial accounts and credit reports for any signs of unauthorized activity.
The breach remains under investigation, with authorities seeking to determine the full scope of the data exposure and the identity of those responsible. As the situation develops, more details are expected to emerge regarding the impact on travellers and the measures being taken to mitigate the risks.