Hackers stole personal data from a European travel company, exposing information of over 300,000 people worldwide and increasing the risk of identity theft. Here’s what happened and how to protect yourself.
Table of Contents
What Happened?
According to SecurityWeek, hackers broke into Eurail, a European travel company, and stole customer data.
The attack happened in December 2025, but Eurail shared the first details only in January 2026. At that time, the company said the breach might have affected some customers.
Eurail confirmed that hackers stole personal data and reported the incident to US authorities.
Now, the travel company is contacting affected people directly to inform them about the breach.
How Did the Attack Happen?
Hackers didn’t just get into one system — they accessed several parts of Eurail’s infrastructure.
They broke into:
- Cloud storage (AWS S3) — this is where the company stores files and data online, like a digital storage space you can access through the internet (similar to Google Drive)
- Customer support system — this is where customer messages and support requests are kept
- Internal development platform (GitLab) — this is where the company stores and manages its website or app code
From there, they stole:
- Customer data
- Support tickets
- Database backups
- Even source code
In total, the hacker claimed to steal about 1.3 terabytes of data.
That’s a very large amount — enough to include years of records.
Who Is Affected and What Was Stolen?
Eurail says the breach affects 308,777 people. Only customers who received a Eurail pass are included.
Hackers accessed files with basic personal information, including:
- Full names
- Passport numbers
- Contact details (such as email or phone number)
The company says hackers did not access or steal:
- Bank or credit card details
- Passport photos
Still, this breach is serious. Passport numbers are sensitive and criminals can use them for identity theft or scams.
How Hackers Used the Stolen Data
After stealing the data, the hackers:
- Tried to negotiate with Eurail
- Said they had data from millions of users
- Later put the data up for sale on the dark web
- Shared a sample of the stolen data on Telegram
This is a common trick. Hackers show some data to pressure companies to pay the ransom.
Eurail confirmed that some of the shared data is real.
This is a good example of how breaches and leaks work together — data gets stolen first, then leaked or sold to cause more damage. To better understand the difference, read our guide on data breaches vs. data leaks.
Why This Breach Is Dangerous
This breach did not include credit card details, but it is still serious.
Here’s why:
- Your passport number is a key piece of identity. Criminals can use it to pretend to be you.
- Stolen data often gets combined with other leaks (like your email or phone), making scams more convincing.
- You may start receiving messages that look real, because scammers already have some of your details.
For example, scammers might contact you and say:
- “There is a problem with your recent trip — confirm your passport details.”
- “Your travel document needs verification — click here to avoid issues.”
- “We need to check your identity to process your booking.”
They may pretend to be:
- A travel company you used
- A visa or border service
- Customer support from Eurail or another provider
These messages can look very real because they include your actual information.
5 Steps to Stay Safe After This Breach
Take these simple steps to stay safe:
1. Watch for unexpected messages
Be careful with emails or texts about your trip, tickets, or passport.
Scammers often use phrases like “urgent,” “verify now,” or “problem with your booking.”
2. Do not click links in messages
Even if the message looks official, don’t click the link.
Instead, open your browser and go to the company’s website yourself.
3. Never share your passport details
No real company will ask you to send your passport number by email or text.
If someone asks for it, treat it as a scam.
4. Check your accounts directly
Log in to your Eurail account or contact support using the official website.
Do not use phone numbers or links from messages.
5. Stay alert for follow-up scams
Scammers may contact you weeks later, pretending to “help” or “fix the issue.”
Take your time and verify everything before responding.
Futureproof monitors your info for data leaks and helps you fix risks early. Get started to protect your information all year long.
Even Trusted Travel Services Can Put Your Identity at Risk — Verify Before You Trust
This breach shows a simple truth: even well-known travel companies can be hacked, and your name and passport number can end up being exposed.
The best habit: Don’t respond right away — instead, check the message on the official website before you do anything.
A few seconds of checking can prevent a big mistake.
At Futureproof, Kevin makes online safety feel human with clear steps, real examples, and zero fluff. He holds a degree in information technology and studies fraud trends to keep his tips up-to-date.
In his free time, Kevin plays with his cat, enjoys board-game nights, and hunts for New York’s best cinnamon rolls.
