Hundreds of thousands face passport replacement after Eurail data breach

Eurail customers who bought Interrail or Eurail passes are now dealing with serious risks to their personal information. Hackers accessed customer records in a security incident in December 2025. Details from roughly 300,000 travellers have now appeared for sale on the dark web, with a sample dataset also shared on Telegram.

Personal details exposed in the incident

Records included full names, dates of birth, home addresses, email addresses, phone numbers, passport numbers and passport expiry dates. Many travellers have to provide passport information during booking or verification for European rail journeys. Eurail has confirmed the data had been copied from its systems but has sor far given no further technical explanation about access methods.

Customers whose details appeared in the sample dataset published on Telegram received direct notifications from Eurail, wherever their contact information was available. Eurail has advised everyone affected to watch carefully for suspicious calls, emails or texts requesting more personal details.

“We take the security of your data seriously and regret any concern this incident may cause,” the company stated. A spokesperson added: ‘We can confirm that data copied during the security incident has been offered for sale on the dark web, and a sample dataset has been published on Telegram.’ Customers whose personal data was included in the sample dataset are being informed directly where contact details are available to us.”

Passport Office instructs cancellation for some Brits

UK authorities responded quickly in at least one confirmed case. HM Passport Office told an affected individual to cancel their passport to stop potential fraudulent use. Replacement applications carry the standard fee of £102 for adults. Similar situations arose elsewhere in Europe. One customer in Denmark reported having to arrange a new passport at a cost exceeding €200.

Affected travellers have voiced frustration over the practical and financial burdens. “It’s an absolute nightmare,” one person told The Guardian. Another questioned the situation: “I genuinely have no idea how serious this is. Do I really need to spend my money doing all this? No one wants to spend £100 when they don’t have to. If the official advice is to get a new passport, there does need to be some sort of compensation.”

Advice for anyone contacted by Eurail

People who received notification should contact their national passport authority without delay if advised to cancel. Monitoring bank accounts, credit reports and online activity becomes essential to spot early signs of identity theft. Eurail has not announced any compensation scheme for replacement costs or related inconvenience.

This breach goes to show ongoing vulnerabilities in travel sector databases that hold sensitive identity documents. Travellers across Europe who used Interrail or Eurail passes in recent years now wonder whether their details sit among the compromised records. Those uncertain about their status can review any recent emails from Eurail or reach out to the company directly.