Eurail passengers taken for a ride as data breach spills passports, bank details

Eurail has confirmed that customer information was stolen in a data breach, with the incident affecting those who received a pass through the DiscoverEU programme and, to some extent, other customers who purchased passes directly from Eurail/Interrail. The incident was first posted on 10 January, and affected customers began receiving notification emails on 13 January 2026.

The updated notice states that the data involved may include order and reservation information and, where provided, passport details such as passport number, country of issuance or expiry date, while noting that Eurail B.V. does not store a visual copy of passports for customers who bought passes directly.

The investigation is ongoing, and there is currently no evidence that data has been misused or publicly disclosed, according to the company’s statements and external cybersecurity specialists monitoring the matter. According to The Register.