Data security incident (updated release)

Utrecht, The Netherlands, 13 February 2026

Update 13 February 2026: Eurail B.V. has confirmed that certain customer data affected by the previously reported security incident has been offered for sale on the dark web and a sample data set has been published on Telegram. We are continuing to investigate the scope and impact.

Eurail B.V. has unfortunately experienced a security breach within its systems that resulted in unauthorized access to customer data. Following the discovery, we immediately began work to secure our systems and initiated an investigation with the support of external cybersecurity specialists and legal advisors.We take this matter very seriously and are currently conducting a thorough investigation to determine the full scope of the incident and its potential impact on customers which includes participants of the European Commission’s DiscoverEU action.

We have become aware that the data has been offered for sale on the dark web and a sample data set has been published on Telegram. We are currently investigating which specific data records or how many of the affected customers this concerns.

The investigation is still ongoing with the support of external cybersecurity specialists and legal advisors. Our early review suggests that the data accessed may include customer order and reservation information, including basic identity and contact details as well as, where applicable, information relating to travel companions. Where provided, it might also include passport information, like passport number, country of issuance or expiry date, which is used to confirm Pass holder identity by ticket inspectors. As a standard procedure, if you purchased your Pass from Eurail B.V., we do not store bank or credit card information, nor do we keep a visual copy of your passport. For customers who received a Pass as part of the DiscoverEU programme, please refer to this statement.

The ongoing investigation will need to provide more information about the precise categories of personal data which are involved. The investigation shows that some of the data that has been accessed, was also copied from the database.  As mentioned above, some of the data has been offered for sale on the dark web and a sample data set has been published on Telegram. However, at this stage, the investigation does not provide information on which specific data this concerns. The external cybersecurity specialists will continue to consistently monitor the dark web forums. 

The incident has been reported to the data protection authority in line with European Union GDPR requirements, and we are in the process of notifying all other relevant data protection authorities outside of the EU (as required by law). 

Customers whose data may have been accessed and published will be informed directly where contact details are available to us. Preventing and mitigating any potential negative consequences for our customers is our highest priority. We encourage customers to remain vigilant for any suspicious or unexpected communications requesting personal information, including phone calls, emails or text messages. Eurail will never request sensitive information through unsolicited contact. As a precautionary measure, customers are advised to update their Rail Planner app password and consider changing passwords linked to their email, social media and banking accounts. Customers should also monitor their bank accounts for unusual transactions and report any concerns to their bank immediately. Further guidance on recommended steps customers can take to protect themselves is available via Eurail’s customer support centre.

We take the security of our customers’ information seriously and regret any concern this incident may cause.

For customer questions, please refer to the FAQs available via Eurail’s customer support centre, or contact privacyhelp@eurail.com

Updated 13 February 2026