Interrail reports data leak: ID data also affected

For over fifty years, the Interrail pass has enabled affordable train travel across Europe. The package deal, which initially targeted young people primarily, is managed by Eurail B.V. in Utrecht, Netherlands. This company is now warning its customers about a data leak: an unknown individual had access to the company's customer database and could have potentially accessed the personal and identification data of Interrail users.

There are not many details about the incident, but Eurail states that the unknown attacker could have accessed the following data:

• Order and reservation information,
• Contact and identification data, and
• Number, issuing country, and expiry date of passport or ID card.

Interrail does not store a copy of the identification document for customers, only the provided data, Eurail explains. However, this does not apply to all customers. Those who purchased a ticket as part of the “DiscoverEU” program must also expect that copies of identification documents, IBANs, and health data may have fallen into the wrong hands, according to a separate announcement.

Details are unclear; investigations are ongoing

Eurail does not explain when the incident occurred or whom specifically they suspect of the intrusion. However, the company is apparently confident that it was only a single individual. They are investigating further details with IT security specialists and forensic experts, have closed the security vulnerabilities, changed compromised access credentials, and strengthened security measures. All directly affected customers have been informed, and the responsible supervisory authority, the Dutch Autoriteit Persoonsgegevens, has also been notified.

Eurail urges its customers to be vigilant. The attackers could use the stolen data to launch phishing or fraud attempts, and identity theft is also conceivable. The company has set up an FAQ to provide further assistance.

Train tickets at a flat or monthly rate are attractive targets for fraudsters and counterfeiters. The Deutschlandticket was offered via illegal shops, causing damages of up to half a billion euros for transport companies since 2024. Copies of identification documents are also popular because they help with identity fraud; they are sometimes traded by the thousands on the darknet.

(cku)