Eurail B.V., the European rail pass company, says it discovered unusual activity inside its network and traced it to an unauthorized actor who copied files off its systems on December 26, 2025. Working with outside cybersecurity investigators and law enforcement, Eurail reviewed those files and, on February 25, 2026, confirmed that some of them contained customer information. This falls under hacking or system intrusion, meaning someone outside the company got into its network and pulled data out rather than an employee mistake or a lost device.
The notification letter is written to a specific named customer, and Eurail has not published an aggregate number of affected individuals in the version of the letter provided. Anyone who booked or held a rail pass through Eurail around the time in question could potentially be included, so if you received this letter, it means your specific record was confirmed to be in the exposed files.
What information was exposed?
- Full name
- Passport number
What should you do now?
- Contact the passport issuing authority in your country to ask whether a compromised passport number can be flagged or whether you should consider requesting a replacement passport, especially if you travel internationally often.
- Watch for phishing attempts that reference Eurail, your travel plans, or your passport — scammers often use real breach details to sound convincing, so never share personal information with anyone who contacts you unsolicited claiming to be from Eurail.
- Check your free credit reports at annualcreditreport.com for any accounts you don’t recognize, even though this breach did not involve Social Security numbers or financial account numbers directly.
- Consider placing a fraud alert or credit freeze with Equifax, Experian, and TransUnion as an extra layer of protection if you’re concerned about identity misuse.
- Since passport numbers can be combined with other leaked data to build a fuller identity profile, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere.
- Keep a copy of this notification letter and any correspondence with Eurail in case you need to reference it later when disputing fraudulent activity or filing a report with authorities.
If you have questions, Eurail B.V. can be reached at 1-833-319-9486, Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern, excluding major U.S. holidays, or by contacting the company directly at Jaarbeursboulevard 286, 5th Floor, 3521 BC, Utrecht, Netherlands, +31 6 18641902.