Full Report
Eurail B.V., a European travel operator that provides digital passes covering 33 national railways, says attackers stole the personal information of over 300,000 individuals in a December 2025 data breach. [...]
Analysis Summary
# Incident Report: Eurail B.V. December 2025 Data Breach
## Executive Summary
Eurail B.V., a Netherlands-based European travel operator, suffered a significant data breach in late 2025 involving the unauthorized exfiltration of a customer database. The incident resulted in the compromise of personal and sensitive information belonging to approximately 308,777 individuals, including travel pass holders and DiscoverEU program participants. Evidence suggests the stolen data was subsequently offered for sale on the dark web and sampled on Telegram.
## Incident Details
- **Discovery Date:** February 25, 2026 (Full impact determined)
- **Incident Date:** December 26, 2025
- **Affected Organization:** Eurail B.V.
- **Sector:** Transportation / Travel / Tourism
- **Geography:** Netherlands (HQ); Global impact (33 national railways covered)
## Timeline of Events
### Initial Access
- **Date/Time:** On or before December 26, 2025.
- **Vector:** Breach of a customer database (Specific technical entry vector not disclosed).
- **Details:** Unauthorized actors gained access to the network and identified file repositories containing traveler information.
### Lateral Movement
- **Details:** The threat actor navigated the network to reach the customer database and file systems used for traveler documentation and the Rail Planner app infrastructure.
### Data Exfiltration/Impact
- **Date:** December 26, 2025.
- **Details:** Unauthorized actors transferred files from the Eurail network to external locations.
- **Dark Web Activity:** Threat actors published a sample of the stolen data on Telegram and attempted to sell the full database on dark web forums.
### Detection & Response
- **Initial Disclosure:** February 2026 (Initial public warning of a database breach).
- **Impact Identification:** February 25, 2026 (Eurail concluded the specific data points and individuals affected).
- **Notification:** March 27, 2026 (Notification letters sent to affected individuals/Attorney Generals).
## Attack Methodology
*Based on the provided article, specific technical techniques used for persistence and evasion were not disclosed.*
- **Initial Access:** Unauthorized access to customer database.
- **Collection:** Gathering of files containing PII and travel documentation.
- **Exfiltration:** Transfer of files from the corporate network on Dec 26.
- **Impact:** Data theft and extortion (sale of data on dark web).
## Impact Assessment
- **Financial:** Possible secondary fraud; monitoring costs for affected users.
- **Data Breach:** Compromise of 308,777 individual records. Data included:
- Full names and contact details (email, phone).
- Passport numbers and ID numbers.
- Bank account IBANs.
- Health information (specific to DiscoverEU participants).
- **Operational:** Management of large-scale breach notification and regulatory reporting to OAG and EU bodies.
- **Reputational:** High-profile impact on major European travel programs (Interrail/Eurail) and the European Commission’s DiscoverEU program.
## Indicators of Compromise
- **Network indicators:** *Not disclosed in the public report.*
- **File indicators:** *Not disclosed in the public report.*
- **Behavioral indicators:** Large-scale unauthorized data transfer/outbound traffic on December 26, 2025; unauthorized Telegram channel posts containing PII.
## Response Actions
- **Containment:** Secured the compromised customer database.
- **Eradication:** Investigation into the scope of file transfer.
- **Recovery:** Restoration of secure operations for the Rail Planner app.
- **User Protection:**
- Advised users to update Rail Planner app passwords.
- Recommended monitoring bank accounts for suspicious activity.
- Issued breach notification letters in compliance with regulatory requirements.
## Lessons Learned
- **Exfiltration Detection:** The lag between the December exfiltration and the February determination of scope suggests a need for improved real-time data loss prevention (DLP) and monitoring.
- **Data Minimization:** While Eurail claimed not to store "photocopies" of passports, the storage of passport numbers and IBANs in a reachable database created significant downstream risk for identity theft.
## Recommendations
- **Access Control:** Implement multi-factor authentication (MFA) across all database administrative interfaces.
- **Encryption:** Use At-Rest encryption for sensitive PII (Passport/IBAN) to ensure that even if data is stolen, it remains unreadable.
- **DLP Implementation:** Deploy Data Loss Prevention tools to alert on large outbound transfers of sensitive file types or database exports.
- **Credential Hygiene:** Force a global password reset for all Rail Planner accounts and encourage users to utilize unique passwords to prevent credential stuffing.