Eurail B.V., a company providing digital rail passes across 33 European nations, reports that a cyberattack in December 2025 compromised the private data of over 300,000 people.

Located in the Netherlands, Eurail provides Interrail and Eurail passes for train travel in Europe. These passes are also available through the EU’s DiscoverEU program to young Europeans.

In February, when the security incident was made public, Eurail stated that hackers accessed sensitive user information, including full names, passport information, identification numbers, bank account details (IBANs), medical data, and contact information (email addresses and phone numbers), by breaking into their customer database.

Eurail also mentioned that the cybercriminals published some of the stolen data on Telegram and were trying to sell it on the dark web.

“Evidence showed that an unauthorized person copied files from our network on December 26, 2025,” the train company said in notifications to those impacted on March 27.

“After reviewing the files, on February 25, 2026, we found that they included some of your personal information, specifically your name and passport number.”

On that same day, Eurail disclosed in a notice to Oregon’s Attorney General’s Office that the breach involved the data of 308,777 individuals.

​While Eurail stated no financial information or photocopies of passports were stored on the affected systems, the European Commission advised that young travelers using DiscoverEU passes may have had their data (including health information) compromised.

Eurail advised customers who had their data exposed to be careful of potential phishing attempts and scams. They also recommended updating passwords for their Rail Planner app account and any other platforms where those passwords were used.

The company also recommended that customers keep an eye on their bank accounts and report any unusual transactions to their bank immediately.

Last month, the European Commission also verified a security breach following a cyberattack on the Europa.eu website, which was claimed by the ShinyHunters extortion group.