Eurail B.V., the company responsible for Interrail passes, has reported a significant security incident involving unauthorized access to their customer database. The breach has exposed personal information, including identity details (names, birth dates, gender), contact information (email, address, phone), and passport data (number, issuing country, expiration).
Additionally, customers participating in the DiscoverEU program are at risk of further exposure, with compromised data that could include ID document copies, IBAN numbers, and health information. While there is no current evidence of misuse of the data, Eurail has issued warnings to customers about potential risks such as phishing attempts, fraud, and identity theft.
In response to the breach, Eurail has taken several measures to secure the affected systems, close the vulnerabilities, reset credentials, and comply with legal requirements by reporting the incident to the Dutch data protection authorities under GDPR. Customers are strongly advised to change passwords across all accounts and remain vigilant for any unauthorized communications or transactions.

Collections

Eurail B.V. experienced a data breach exposing customer personal information including names, birth dates, contact details, and passport data. DiscoverEU participants face additional risk with potential exposure of ID copies, IBAN numbers, and health information. The company has secured systems, closed vulnerabilities, reset credentials, and reported to Dutch authorities under GDPR. Customers are advised to change passwords and watch for phishing attempts and fraud.

Eurail Data Breach: Customer Information Compromised