Hacker attack in the Netherlands: Interrail with long-term consequences

A large amount of personal customer data was stolen in a hacker attack on the Dutch company Eurail BV. Users of the are affected Train tickets valid throughout Europe Interrail and Eurail, which are distributed by the Utrecht-based company. Anyone who purchases these online leaves behind standard data such as name and address, email address and telephone number, and sometimes also the number and expiry date of travel documents.

A statement from Eurail speaks of a “security incident” in which “an unauthorized person gained access to part of our customer database”. The company took direct measures to secure its systems and called in external specialists to investigate the incident. The ongoing investigation is expected to provide more detailed information about the personal data in question. According to the statement, there are currently no indications that these are being misused or distributed publicly.

Eurail does not mention when exactly the attack took place or how many data sets were involved. The Belgian daily newspaper The Standard quotes a company spokesman, according to whom there could be “tens of thousands of victims.” In recent days, affected customers have been informed by email that their data has been stolen and asked to change their passwords immediately. The Eurail statement, written in several languages, advises people to be “particularly vigilant” against unexpected or suspicious contacts and not to provide personal information.

The potential scope of the data leak can be seen from a look at Eurail BV’s current sales figures. In 2024, there were a total of more than 1,149,000 tickets are valid in 33 European countries. Almost two thirds of these were Interrail passes, the rest Eurail, the similar product for travelers from outside Europe. Incidentally, 98 percent of the latter chose the online version of the passport instead of the previous paper version. In contrast, 88 percent of Interrail customers did.