AI-generated · no human review · verify critical claims against the linked source.how it works →
Eurail breach
incident
· incident:eurail-breach-2026
Eurail breach: an unauthorized actor transferred files from Eurail's network on 2025-12-26, and Eurail sent letters on 2026-03-27 to 308,777 people whose names and passport numbers were exposed (BleepingComputer, 2026-04-09).
Coverage
1
first 2026-05-08 → last 2026-10-21
Latest activity
2026-05-08
Eurail sent breach letters to 308,777 travellers on 2026-03-27, three months after attackers copied its…
Peak priority
routine
1 routine
Targets
·
regions: europe
Sources cited
2
2 hosts
Defender insights
What each entry about Eurail breach tells a defender to do, newest first.
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
CollectionData from Information Repositories: Databases
Collection TA0009
T1213.006Data from Information Repositories: Databases×1
Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments).
Eurail, the Netherlands-based seller of Interrail and Eurail passes and supplier of the EU's DiscoverEU programme, says an unauthorized actor transferred files from its network on 2025-12-26 and sent letters on 2026-03-27 to 308,777 people whose names and passport numbers were exposed (BleepingComputer, 2026-04-09), and the European Commission told DiscoverEU participants that passport or ID copies, IBANs and health data may also be involved (European Commission, 2026-01-13). Eurail's February disclosure said the attackers reached the travellers' data after breaching its customer database (BleepingComputer, 2026-04-09).
The earlier text said Eurail began sending notifications in late April 2026 and that the Dutch data protection authority and the EDPS had opened reviews of the delay. Eurail sent its letters on 2026-03-27 (BleepingComputer, 2026-04-09), and the Commission states only that the EDPS was notified of the breach (European Commission, 2026-01-13). The earlier text also said the breach exposed passport numbers, IBANs and DiscoverEU pass details, and advised affected people to consider replacing their IBAN. Eurail's letters list names and passport numbers, and Eurail says it stored no financial information on the compromised systems, although its February disclosure listed IBANs and health information (BleepingComputer, 2026-04-09). The Commission says DiscoverEU participants' IBANs and health data may be involved (European Commission, 2026-01-13). The earlier text also said Swiss nationals who applied through a bilateral arrangement may be affected, which no source supports.