Eurail Data Breach Exposes Passports and Bank Details of Customers

Eurail, also known as Interrail in the EU, experienced a data breach that compromised customer information. The company announced the incident on January 10, 2023, and began notifying affected customers on January 13. The breach potentially exposed various personal data, including first and last names, dates of birth, genders, email addresses, home addresses, telephone numbers, passport numbers, passport issuing countries, and passport expiration dates.

Notably, customers who obtained travel passes directly from Eurail did not have visual copies of their passports stored on the company’s systems. However, those who received passes through the DiscoverEU program may have had additional sensitive information compromised, including photocopies of IDs, bank account reference numbers, and health data.

The European Commission has stated that there is currently no evidence of misuse or public disclosure of the stolen data, but they are monitoring the situation with external cybersecurity specialists. Eurail has assured that it has secured the affected systems, closed the vulnerability, reset credentials, and enhanced security controls following the breach.

The incident has been reported to the Dutch data protection authority, in compliance with GDPR regulations. Eurail expressed regret for any concerns this incident may cause and is directly informing customers whose data may have been accessed.

Understanding the Risks

As a result of this breach, customers may face risks such as phishing and spoofing attempts, unauthorized access, and identity theft. The emails sent to affected customers include guidance on identifying potential scams and recommend changing passwords for all accounts.

This incident highlights the importance of data security for organizations handling sensitive personal information. Users should remain vigilant and proactive in protecting their data, especially when breaches occur.