- Hackers stole thousands of travelers’ personal information like passport numbers, contact details, health data, etc from Eurail BV in a recent breach.
- Samples of the data are now for sale on the dark web, with some datasets already floating on Telegram channels.
- It would cost victims £102 or more to replace their passports, some are demanding compensation from the rail company.
Eurails, a popular European rail pass company, faced a data breach, exposing the sensitive data of over so many travelers. Now, hackers have put up the stolen information for sale on the dark web for other criminals to buy.
Affected travelers are at risk of their data being used to scam them, and canceling their passports seems to be one way to protect themselves.
Details of the Breach
In January, Dutch-based Eurail BV announced an earlier incident involving a data breach that impacted more than three hundred thousand customers from various countries throughout Europe. The company has since completed its internal investigation into what caused the breach, and what they found doesn’t bode well for customers.
Recently, Eurail admitted that threat actors have offered the stolen data for sale on the dark web. A sample of that dataset even appeared on the messaging app Telegram. This means bad actors can buy people’s private details and either resell or use it to commit other crimes.
The music streaming industry has also faced significant data breaches. SoundCloud recently confirmed a data breach affecting nearly 30 million users, demonstrating that no sector, from travel services to music platforms, is immune to cyberattacks that expose massive amounts of user data on underground markets.
The leaked information includes very sensitive travelers’ data. There are passport numbers. ID card numbers. Full names and phone numbers. That’s not all. Email addresses, home addresses, and even dates of birth are part of the leak.
Combine all these and criminals have a complete identity package they can use for financial fraud, phishing scams, and identity theft. Even bank account references and some health data were leaked as well.
So what should you do next? Eurail says it does not store bank or credit card numbers. They also do not keep a visual copy of passports. But that does not fix the problem for victims.
Travelers Frustrated and Scared
Victims are now angry and confused. One customer wrote on Reddit saying they’ve emailed Eurail asking if they’ll reimburse the costs for getting a new passport because this is the first ever leak affecting their passport number.
Another person shared their fear online. “I am currently an exchange student in a different country, so I can’t even get a new passport, so I am scared.”
Some passengers are completely don’t know what to do next. One user asked: “Am I meant to apply for another passport now? They got an email saying their data is already up for sale on the dark web, but they’re clueless about what action to take.
Former broadcast journalist Gerard Tubb, 64, from Yorkshire, was affected too. Tubb had bought Interrail tickets as he wanted to travel to the southern part of France. He said the concern is the things people can do with such an amount of information. According to Tubb, a lot is at stake; criminals can even use it to steal his identity in order to deceive someone.
Who is Affected and How to Stay Safe
The breach also hit young travelers. The European Union’s DiscoverEU program gives away 40,000 Interrail passes each year to 18-year-olds. Those residents of EU member states could have had their ID photocopies stolen.
DiscoverEU stated it does not know how many people the breach affected. There is no evidence yet of misuse, but Eurail is monitoring the situation. At the moment, British passport holders cannot get a DiscoverEU pass. However, they’ll be accessible next year via Erasmus+.
So What’s the Next Step for Victims?
Eurail and DiscoverEU released a joint statement, saying their top priority is to prevent and minimize the potential impact of the breach for customers. They then advised customers to remain alert in case someone sends calls, emails or sends text messages claiming to be from Eurail. Moreso, Eurail would never ask customers for their personal information suddenly.
They advise updating your Rail Planner app password. Also, change any passwords linked to your email, social media, and bank accounts. And monitor your bank for unusual transactions.
It costs a British citizen £102 to replace their passport. The Home Office said the final decision on whether to get a new passport is on the passport holders themselves. They added that British passports use modern security technology to help prevent criminals from attempting to forge or fake them. One affected customer in Denmark said they had to cancel their passport, and a replacement may cost over £200.
Some travelers are now fighting back. One user wrote to Eurail’s CEO demanding compensation under Article 82 of the GDPR. The Home Office has stated that it is between the applicant and the third party responsible for the data breach as to whether they can afford to replace their passport or not. However, Eurail has yet to respond to media inquiries regarding the matter.
