Eurail B.V. has confirmed a data breach affecting 308,777 individuals in the United States. Among them are 242 people from New Hampshire.
The incident took place between the end of December 2025 and early January 2026. During this period, an unauthorized individual accessed the company’s systems and removed files. Eurail detected the issue after noticing unusual activity on its network and later verified that personal information had been exposed.
The company traced the unauthorized access back to December 26, 2025, when files were transferred out of its systems. Once the activity was identified, Eurail initiated its internal response procedures and brought in external cybersecurity specialists to investigate. Law enforcement agencies were also informed and remain involved.
By February 25, 2026, the company confirmed that the files involved contained personal data. Notifications to affected individuals and regulatory authorities began on March 27, 2026, including disclosures to officials in California, New Hampshire, Oregon, and Vermont. Eurail also published a notice through the European Youth Portal.
For users in the United States, Eurail stated that the exposed data includes names and passport numbers. However, earlier findings connected to the same incident suggest that the breach may not be limited to this information.
Previous disclosures indicate that the dataset may also include email addresses, phone numbers, international bank account numbers, financial details, and health-related information. When combined, these types of data increase the chances of identity misuse, financial fraud, and longer-term exploitation.
Earlier this year, Eurail acknowledged that data linked to a previous breach had been listed for sale on dark web platforms, with samples appearing on Telegram. This points to the possibility that the incident extended beyond initial containment and became part of a broader exposure.
The impact may also include customers who purchased Eurail or Interrail passes through partner platforms. In addition, the DiscoverEU initiative issued a warning that sensitive records, including passport copies and financial information, could have been affected.
In response, Eurail stated that it has blocked the unauthorized access and strengthened its internal security systems. The company continues to work with law enforcement and cybersecurity experts while assessing the full scope of the incident.
Users have been advised to remain cautious, particularly when receiving unexpected messages asking for personal information. Eurail recommends avoiding any interaction with unknown contacts claiming to represent the company.
Customers are also encouraged to keep a close watch on their financial accounts and check credit reports for unusual activity. In the United States, individuals can access one free credit report each year from the major credit bureaus. Anyone who suspects misuse of their data should report it to the Federal Trade Commission, contact their state attorney general, and inform local law enforcement.
This incident draws attention to the risks linked to large travel platforms that store sensitive identity and financial data. Information such as passport numbers cannot be easily changed, which makes its exposure particularly serious.
As the investigation continues, the breach adds to growing concerns around how travel data is handled and protected. Systems that manage this kind of information require constant monitoring and stronger safeguards, especially as they become more interconnected and valuable to attackers.