Passport Chaos for Thousands After Eurail Hack Exposes Travel Data

Tens of thousands of European travelers are scrambling to replace their passports after a cyberattack on Eurail, the company behind the popular Interrail passes, leaked personal details on the dark web. The breach, which occurred in December, exposed names, passport numbers, email and home addresses, phone numbers, and dates of birth for over 300,000 customers. This week, Eurail confirmed that the stolen data was being offered for sale online, with a sample posted on Telegram.

Victims now face a costly and stressful ordeal. The UK Passport Office told one traveler they must cancel their passport to prevent fraud, and pay the full £102 fee for a replacement. A customer in Denmark reported a similar requirement, with a new passport expected to cost over £200. One anonymous traveler, whose data was stolen along with a friend’s after a rail trip from Penzance to Naples, described the situation as “an absolute nightmare.” She said the dark web posting “freaked me out” and questioned whether she should spend money on a new passport without clear official guidance or compensation.

Eurail advised customers to stay alert for suspicious calls or emails, update passwords, and monitor accounts. But many are angry. Gerard Tubb, a 64-year-old former journalist from Yorkshire, said the company’s apology felt hollow: “They didn’t take security seriously. Who picks up the pieces if someone uses this?” On Reddit, affected users have called for collective action under GDPR, with one writing to Eurail’s CEO demanding compensation under Article 82. Eurail said it is notifying all impacted customers and apologized for the unease, insisting it remains committed to protecting data. The Home Office has been contacted for comment.