Interrail/Eurail Data Breach

[nilvaj395]

EuRail/Interrail has reported a data breach to customer data following someone gaining unauthorised access to the database.

Eurail B.V. has unfortunately experienced a security breach within our systems that resulted in unauthorized access to customer data. Following the discovery, we immediately began work to secure our systems and initiated an investigation with the support of external cybersecurity specialists and legal advisors. We take this matter very seriously and are currently conducting a thorough investigation to determine the full scope of the incident and its potential impact on customers, which includes participants of the European Commission’s DiscoverEU action.

The investigation is still ongoing. Our early review suggests that the data involved may include customer order and reservation information, including basic identity and contact details. Where provided, it might also include your passport information, like passport number, country of issuance or expiry date. As a standard procedure, if you purchased your Pass from Eurail B.V. we do not store a visual copy of your passport. For customers who received a Pass as part of the DiscoverEU programme, please refer to this statement.

 

[eastwestdivide]

They just emailed me saying basically that. Also:

As an extra precaution, we recommend updating the password you use to access your Rail Planner app

Hmmph

 

[Merseysider]

I just noticed that email.

Change your password for this site and for any other websites with the same password.

 

[ainsworth74]

Yep same email received here as well, a copy for anyone interested who has not had one:

​

Dear Customer, We’re writing to inform you about a security incident that occurred at Eurail B.V., who also sells Interrail Passes. An unauthorised person gained access to part of our customer database. This means that someone outside Eurail has been able to access certain customer details. Following the discovery, we immediately began work to secure our systems and initiated an investigation with the support of external cybersecurity specialists. We take this matter seriously and are currently conducting a thorough investigation to determine the full scope of the issue and its potential impact on your data.

​

What does this mean for you? Although our investigation is still ongoing, our early review indicates that your personal data has been accessed, which may include: Identity information: first name, last name, date of birth, gender; Contact information: email address, home address, telephone number, if provided; Passport information: passport number, country of issue and expiration date (not including copies of the documents). The ongoing investigation should provide more information about the precise categories of personal data which are involved and to what extent personal data has also been copied from our customer database. At this time, we have no evidence that your data has been misused or publicly shared. This is monitored by our external cybersecurity specialist on a continuous basis. Preventing and mitigating negative consequences for you is our highest priority. Therefore, in addition to informing you about the incident, we would like to provide you with guidance on how to recognise fraud and what to do if you suspect your personal data is being misused. Criminals may attempt to misuse your data. Therefore, we advise you to remain extra vigilant for unexpected or suspicious phone calls, emails, or text messages asking you for personal information. If in doubt, never share your information with someone who contacts you unsolicited or claims to work for Eurail. As an extra precaution, we recommend updating the password you use to access your Rail Planner app. The general recommendations in data breach cases are also to change passwords linked to your email address, social media, and banking, for example, and to pay particular attention to any unusual transactions in your bank account and report them to your bank immediately. For additional tips, we advise you to consult this information page from the Data Protection Authority: https://autoriteitpersoonsgegevens.nl/en/themes/security/data-breaches/victim-of-a-data-breach-this-is-what-you-can-do

​

What we are doing We have secured our systems and are: working with external cybersecurity specialists continuing a detailed investigation into the incident informing the relevant authorities, as required by law.

​

Concluding remarks We take the security of your data seriously and regret any concern this incident may cause. We will inform you once we have more information about this incident, which is of your concern. For further updates and support on this matter, please refer to our customer support article. If you have any questions, you can also contact us at privacyhelp@eurail.com Thank you for your attention. With kind regards, Eurail B.V.

 

[Full Standing]

This is sad to hear.

As an extra precaution, we recommend updating the password you use to access your Rail Planner app.

Change your password for this site and for any other websites with the same password.

Curious why they recommend updating the password. Let's hope that they don't store the passwords on their servers though!

(It is standard industry practise to never store passwords but only data that can be used to check whether a given password is correct, but from which the password can't be inferred. If interested, see for instance Wikipedia articles on hashing (https://en.wikipedia.org/wiki/Hash_function) and cryptographic salt (https://en.wikipedia.org/wiki/Salt_(cryptography))

 

[railfan99]

As one who only ever purchases Eurailpasses of the paper version, I also received the message.

Why did it take Eurail at least 48 hours (given in Netherlands time, the information is dated '10 January 2026') to forward this email?

I may be less affected than others as I don't use the Rail Planner app.

How does Eurail know that our data hasn't been misused?

No mention in any of its 'FAQs' as to compensation.

Cyberattacks apparently largely emanate from nations like mainland communist China and Russia with resultant scam initiators often having 'bolier rooms' if that's the correct term in countries like Malta, eastern Europe, south east Asia et al. Anywhere where they can find slack law enforcement and people to man computers and phones who can speak English, or design scams.

How many hundreds of thousands of Eurail/Interail users have been affected?

 

[rvdborgt]

They just emailed me saying basically that. Also:

As an extra precaution, we recommend updating the password you use to access your Rail Planner app

There is no such password. There is a password for your account on the Interrail or Eurail website. But that's not needed to access the app.

 

[ainsworth74]

Curious why they recommend updating the password. Let's hope that they don't store the passwords on their servers though!

Good practice whenever there's a breach of security to recommend password changes. It almost certainly isn't necessary (unless their security is utterly appalling) but still best practice.

 

[nilvaj395]

As one who only ever purchases Eurailpasses of the paper version, I also received the message.

Why did it take Eurail at least 48 hours (given in Netherlands time, the information is dated '10 January 2026') to forward this email?

I may be less affected than others as I don't use the Rail Planner app.

How does Eurail know that our data hasn't been misused?

No mention in any of its 'FAQs' as to compensation.

Cyberattacks apparently largely emanate from nations like mainland communist China and Russia with resultant scam initiators often having 'bolier rooms' if that's the correct term in countries like Malta, eastern Europe, south east Asia et al. Anywhere where they can find slack law enforcement and people to man computers and phones who can speak English, or design scams.

How many hundreds of thousands of Eurail/Interail users have been affected?

The legal limit I believe is 72, but you are right, it is poor to send an email days after the web news release. Also you're right no mention of any compensation whatsoever. It annoys me when companies go "oopsies your personal information and/or banking and/or passport number might've been leaked, we'll try better next time".

It dosen't even have to be a state actor, anyone with access to the dark web can likely access any stolen records on anyone and do a whole host of nefarious things.

 

[DanielB]

I'd also be curious why they apparently store your ID information on their servers as they don't need it for anything. The ID-number is only required in case of a ticket check, to compare with your ID, so could also be stored locally.
And at least they should delete it after a pass has expired as then it's no use anyway to have an ID-number coupled to it.

 

[rvdborgt]

I'd also be curious why they apparently store your ID information on their servers as they don't need it for anything. The ID-number is only required in case of a ticket check, to compare with your ID, so could also be stored locally.
And at least they should delete it after a pass has expired as then it's no use anyway to have an ID-number coupled to it.

The next question is why they need an ID number at all. Electronic tickets usually just require a name and maybe a birth date.

 

[nilvaj395]

The next question is why they need an ID number at all. Electronic tickets usually just require a name and maybe a birth date.

I guess as a passport ID is more difficult to forge than a fake name/birth date, but still as @DanielB said this should be locally stored.

 

[MrJeeves]

But that's not needed to access the app.

Except when it throws you at a login page when you open the app and forces you to sign back in to do anything except close the app... It did this to me yet again today.

I know I've said it before here, and I'll say it again, mainly because support fobbed me off when I tried to report it to them as a bug.

I'd also be curious why they apparently store your ID information on their servers as they don't need it for anything. The ID-number is only required in case of a ticket check, to compare with your ID, so could also be stored locally.

It is encoded into the barcode, just like the name and date of birth are.

The barcodes need to be generated by Eurail rather than by the app for security.

 

[nilvaj395]

It is encoded into the barcode, just like the name and date of birth are.

The barcodes need to be generated by Eurail rather than by the app for security.

Fair enough!

 

[rvdborgt]

Except when it throws you at a login page when you open the app and forces you to sign back in to do anything except close the app... It did this to me yet again today.

I've never seen something like that.
I've never needed to enter any Eurail password to use the app. The only instance where it is needed, and this is fairly new, is to access within the app any reservations you may have booked on the Interrail/Eurail website. But you're not forced to access them that way and you can use the app without logging in anywhere.

As to the issue you were seeing (although we should maybe move that to another thread): I'm very curious what exact steps you did after starting the app to land there. And to see a screenshot.

 

[fandroid]

I don't think that our main worry should be about our Interrail accounts per se, but about the potential for personal id theft that the stolen data could facilitate. I'm normally quite secretive about my passport number so having it floating about in the criminal world with my date of birth and other information is quite concerning.

 

[Angmering1974]

I've never seen something like that.

...

I've never needed to enter any Eurail password to use the app.

...

I'm very curious what exact steps you did after starting the app to land there. And to see a screenshot.

Why do you reply to reports of bugs in such a doubting manner? You did the same to me the other day. It comes across as calling us liars. Do you work for Eurrail?


== Doublepost prevention - post automatically merged: 14 Jan 2026 ==

I don't think that our main worry should be about our Interrail accounts per se, but about the potential for personal id theft that the stolen data could facilitate.

Absolutely agree. Passport data breach is extremely serious

 

[rvdborgt]

Why do you reply to reports of bugs in such a doubting manner? You did the same to me the other day. It comes across as calling us liars. Do you work for Eurrail?

I don't work for Eurail and I don't ever doubt what others are seeing or mean to call anybody a liar. I know that the app can sometimes behave strangely in ways we haven't seen before.
I like to research what causes a problem and look for possible workarounds, to be able to report a bug and help people to use the app. If I can't reproduce something, then the steps to reproduce are needed and screenshots often help to understand what someone is seeing.

== Doublepost prevention - post automatically merged: 15 Jan 2026 ==

About the passport/ID card number:

It is encoded into the barcode, just like the name and date of birth are.

The barcodes need to be generated by Eurail rather than by the app for security.

That shouldn't mean, however, that the passport number needs to be stored on a Eurail server after generating a barcode.
Similar for paper passes: after printing a pass, the passport number isn't necessary anymore.

 

[MrJeeves]

That shouldn't mean, however, that the passport number needs to be stored on a Eurail server after generating a barcode.

Well before the changes last year to only include the last 3-digits of the ID number, the full ID number would be in the barcode. So sure, you wouldn't need the ID number stored, but the barcode would still be stored on the server, and store the ID number anyway.

Similar for paper passes: after printing a pass, the passport number isn't necessary anymore.

Paper passes shouldn't even have an ID number on them in the first place, since mid-2025. It should be all asterisks.

 

[rvdborgt]

Well before the changes last year to only include the last 3-digits of the ID number, the full ID number would be in the barcode. So sure, you wouldn't need the ID number stored, but the barcode would still be stored on the server, and store the ID number anyway.

Is the barcode stored on the server then? Why would that be needed?
The pass details in the app still contain the complete ID/passport number. You just need to tap a few extra times to see it.

Paper passes shouldn't even have an ID number on them in the first place, since mid-2025. It should be all asterisks.

I have now indeed seen some paper passes without ID numbers, from various sales points. Has this instruction/rule been published somewhere?
In any case, they should have removed that field last year then from the order form. AFAIK it's not allowed to collect data you don't need.

 

[MrJeeves]

Is the barcode stored on the server then? Why would that be needed?

The barcode gets refreshed from the server now and then, which is why you might see a skeleton-style loading screen when you try to view the pass on a poor connection.

The Rail Planner app will also retain the same barcode for a pass day when you transfer a pass from one device to another rather than generating a new ticket.

The barcode details also need to be stored so that it can be cancelled in the new pan-European ticket control system if someone deactivates a pass day: https://uic.org/passenger/passenger-services-group/etcd

I have now indeed seen some paper passes without ID numbers, from various sales points. Has this instruction/rule been published somewhere?

There was some info bulletin shared by Interrail/UIC ticketing group about it, which also got forwarded to Rail Delivery Group who issued a staff brief on the subject last summer with specimen examples from B.V. of the mobile pass showing last 3 digits and all-asterisks for the paper pass.

I'm not sure why they have last 3 digits on one but not the other.

 

[mrlegohead]

Having bought a pass in the summer from myinterrail.co.uk I have only just now recieved an email from interrail.eu - the same email as others have posted

== Doublepost prevention - post automatically merged: 29 Jan 2026 ==

I appreciate myinterrail.co.uk is winding up, but not telling me officially for 2 weeks+ is appalling. If I weren't a forum user - as are my friends, whom I bought passes for at the same time - I would have had no idea. And now I have to be the bearer of bad news to them.

 

[rmHawk765]

Cyberattacks apparently largely emanate from nations like mainland communist China and Russia with resultant scam initiators often having 'bolier rooms' if that's the correct term in countries like Malta, eastern Europe, south east Asia et al. Anywhere where they can find slack law enforcement and people to man computers and phones who can speak English, or design scams.

The association between cyberattacks and Russia, while historically not entirely unbased, is getting quite absurd. People seem to not consider the commonplace usage of VPNs nowadays...
I doubt the Russian or Chinese governments care the slightest about Eurorail users. Let's not turn this into a political discussion though.

 

[158801]

How would the data breach work if I had purchased a pass through an agency like Ffestiniog Travel.

The6 would issue the ticket but would eurail still have my details and would I be open to the breach

 

[U-Bahnfreund]

Update 13 February 2026

We have become aware that the data has been offered for sale on the dark web and a sample data set has been published on Telegram. We are currently investigating which specific data records or how many of the affected customers this concerns.

Our early review suggests that the data accessed may include customer order and reservation information, including basic identity and contact details as well as, where applicable, information relating to travel companions. Where provided, it might also include passport information, like passport number, country of issuance or expiry date, which is used to confirm Pass holder identity by ticket inspectors.

More about this here: https://www.interrail.eu/en/ni/data-security-incident

 

[MrJeeves]

They would issue the ticket but would eurail still have my details and would I be open to the breach

Yes

 

[Toller Station]

I have recently purched a rail pass through Eurail despite the data leak. Today I received a survey email to my email address which begins ‘Hi Weng Xianglin’. I am not Weng and one wonders whether they still have issues. I checked my account and no mention of Weng but clearly the data, data security and programming stuff isn’t their strong point.

 

[nilvaj395]

Having bought a pass in the summer from myinterrail.co.uk I have only just now recieved an email from interrail.eu - the same email as others have posted

== Doublepost prevention - post automatically merged: 29 Jan 2026 ==

I appreciate myinterrail.co.uk is winding up, but not telling me officially for 2 weeks+ is appalling. If I weren't a forum user - as are my friends, whom I bought passes for at the same time - I would have had no idea. And now I have to be the bearer of bad news to them.

Late to reply, but myinterrail.co.uk are rubbish. Their support compared to Interrail is next to nothing and their refund policy isn't as generous as Interrail itself. I booked a pass once with them and had to cancel it, which was an entire process to begin with but had I booked it with Interrail EU I would've had a full refund as opposed to losing £40 in their percentage you get back for a refund + a admin fee for that refund.