Eurail’s “1.3TB Mega-Leak” (Feb 18): What’s Confirmed, What’s Claimed, and What Travelers Should Do Now
A guide to the Eurail/Interrail data security incident: the facts from official notices, what threat actors are claiming, why travel data is uniquely risky, and a practical checklist to protect yourself from phishing and identity fraud.
TL;DR (60 seconds)
- Confirmed by Eurail: a security breach led to unauthorized access to customer data; some accessed data was copied; Eurail says the data was offered for sale and a sample was posted on Telegram. (Updated Feb 13, 2026)
- May be involved (Eurail customers): order/reservation info, identity/contact details, travel companion info, and where provided, passport number + issuing country + expiry date. Eurail also says it does not store bank/credit card details for direct purchases, nor a visual copy of passports.
- DiscoverEU participants: EU notice warns data may include passport/ID info or photocopies, IBAN, and health data (where applicable).
- Feb 18 “1.3TB” spike: multiple outlets reported threat-actor claims of ~1.3TB and possible exposure of systems like cloud storage/support/code repositories. Eurail has not publicly confirmed the dataset size or “source code” scope.
- Do this now: change your email password, then your Rail Planner/Eurail password, turn on MFA, and treat “urgent travel” messages as suspicious—especially refund/verification links.
1) What happened (timeline that makes sense)
On paper, Eurail and Interrail are simple products: a pass that lets you hop trains across Europe with minimal friction. In practice, modern travel passes create a dense trail of data—names, birthdays, contact details, reservation context, and sometimes passport metadata used for identity checks on-board.
In early 2026, that data became the center of a fast-moving security incident. Eurail’s official statement says it experienced a security breach that resulted in unauthorized access to customer data. After discovery, it says it secured systems and launched an investigation with external cybersecurity specialists and legal advisors. In its February 13, 2026 update, Eurail adds a critical escalation: it became aware that affected data was offered for sale and that a sample dataset was published on Telegram.
Important: “Feb 18” is when the story went mainstream as a “mega-leak,” but the incident narrative spans weeks. When you assess your risk, rely on what’s confirmed by official notices, then treat everything else as “reported/claimed” until independently verified.
2) Confirmed vs claimed (read this before you share scary screenshots)
Confirmed (official statements)
- Eurail experienced a security breach leading to unauthorized access to customer data.
- Some accessed data was copied from the database.
- Eurail says it became aware the data was offered for sale and a sample dataset was published on Telegram.
- Eurail advises customers to update the Rail Planner app password, consider changing passwords linked to email/social/banking, and monitor accounts for unusual transactions.
- For direct purchases from Eurail, it says it does not store bank/credit card info and does not keep a visual copy of passports.
Claimed / reported (treat as unverified until confirmed)
- The dataset totals roughly 1.3TB.
- “Full source code” was taken.
- Specific platforms like AWS S3, Zendesk, and GitLab are included (and contain backups/tickets/repos).
- Exact record counts and which years of data are included.
Why this matters: You can protect yourself effectively without assuming the most extreme version of the story. The correct approach is: act on the confirmed risk (phishing + identity fraud potential), then adjust if scope is expanded by verified updates.
A simple rule
If a claim does not appear in Eurail’s official update or the EU’s DiscoverEU notice, label it as “reported by security outlets” and avoid repeating it as fact. That’s how you stay credible and keep readers safe.
3) Who is affected (quick self-check)
One reason this story feels confusing is that Eurail sits at the center of a network: direct sales, partner channels, seat reservations, and a major EU youth travel program (DiscoverEU). Your “bucket” affects what data you likely provided and what the highest-risk scenarios look like.
Find your bucket
-
DiscoverEU participant?
If you received your pass through DiscoverEU (Erasmus+), follow the DiscoverEU-specific guidance below. The EU notice warns that passport/ID photocopies, IBAN, and health data may be involved (where applicable).
-
Did you buy a Eurail or Interrail pass (directly or via a
partner)?
Eurail says the incident may impact customers issued a pass, including those who purchased through partner channels or distributors.
-
Did you reserve seats through Eurail?
Some reporting notes that customers who reserved seats via Eurail may be included in the affected population. If you did, assume higher exposure of reservation context.
If you are not sure: act as if you might be affected (password changes + phishing vigilance). Those steps are low-cost and high-impact.
4) What data may be involved (and why travel data is uniquely sensitive)
For Eurail/Interrail customers (per Eurail)
Eurail’s early review suggests the accessed data may include: customer order and reservation information, including basic identity and contact details, and, where applicable, information relating to travel companions. It also says that, where provided, it might include passport information such as the passport number, country of issuance, or expiry date—used by ticket inspectors to confirm identity.
What Eurail says is NOT stored (for direct purchases)
Eurail states that if you purchased your pass from Eurail B.V., it does not store bank/credit card information, and it does not keep a visual copy of your passport.
For DiscoverEU travelers (per the European Youth Portal)
The European Youth Portal’s notice warns that personal data may include, where applicable: name/surname/date of birth (or age), passport/ID information or photocopies, email and postal address, phone number, bank account reference (IBAN), and data concerning health. It also outlines likely consequences: phishing/spoofing attempts, unauthorized access, and identity theft.
Why this kind of data is high value for scammers
A retail breach often gives criminals “a list of emails.” A travel breach can give criminals: identity signals (DOB, passport metadata), movement context (trip timing, reservations), and social context (travel companions). That combination makes scams believable.
In other words, the biggest danger is not cinematic “passport forgery on day one.” The biggest danger is precision social engineering: urgent messages that look official, mention your pass or upcoming trip, and trick you into logging in, paying, or “verifying.”
5) Why the “1.3TB + source code” claim matters (even if it’s not fully confirmed)
The “1.3TB” number became the headline because it suggests something bigger than a single table export. Large leaks often imply multiple systems, backups, or internal tools—exactly what threat actors claimed in public posts analyzed by security outlets on and around February 18.
Here’s the practical way to understand the risk without getting lost in technical detail: more systems potentially means more data types, and it can also create a “long tail” of follow-on attacks.
If backups were taken
Backups can contain older records and multiple versions of the same data. That expands the time window of exposure. It also makes it easier for criminals to cross-reference identities.
If support tickets were taken
Support messages can include extra context: address changes, travel issues, verification steps, even partial documents. That context supercharges phishing because scammers can mimic real support workflows.
If code repos were taken
Code exposure can reveal hidden endpoints, business logic, and operational terminology—making both fraud and phishing more convincing. It can also help attackers look for accidentally exposed secrets (tokens/keys).
Again: Eurail’s official statement confirms a breach + copied data + sale/Telegram sample. It does not confirm the dataset size or “source code dump.” Treat the “1.3TB + platforms + source code” details as threat-actor claims reported by outlets.
6) What criminals actually do with travel data (threat model in plain English)
When scammers have identity and travel context, they optimize for what works at scale: high-conversion messages that create urgency, look official, and push you to click or pay. These are the most common playbooks in travel-related breaches:
A) “Your pass is at risk” account takeover phishing
You receive an email or SMS that looks like a service notification: “Suspicious login,” “payment failed,” “reservation canceled,” “verification required,” or “refund pending.” The goal is almost always the same: steal your password (and ideally your email access).
- “Your Rail Planner account will be suspended in 2 hours. Confirm identity now.”
- “Seat reservation failed. Re-enter details to avoid losing your spot.”
- “Refund available: verify passport number to receive funds.”
B) “Customer support” impersonation (email + WhatsApp + Telegram)
If scammers can reference your trip details or the correct product name (Eurail vs Interrail, pass type, dates), they can impersonate support on chat platforms. They may ask you to “confirm” personal data or request a small payment to “reactivate” a pass.
C) SIM swap and one-time passcode interception
When breaches expose enough identity details (name, DOB, phone number, address), criminals can attempt a SIM swap: convincing a mobile carrier to move your number to a new SIM, then using SMS codes to reset accounts. This is why app-based MFA and passkeys matter.
D) “Border emergency” or “family panic” scams
Travel context enables a nasty style of scam: a message to parents/partners claiming you were detained and need money. If the scammer knows the approximate date and country of travel, it becomes far more believable.
E) Identity fraud and account opening attempts
Passport metadata alone is not a magic skeleton key, but combined identity datasets can be used for: fraudulent account creation, “know-your-customer” probing attempts, and targeted social engineering against banks and fintech apps. For DiscoverEU travelers, the EU notice includes IBAN as a potential data element—raising the importance of bank monitoring.
7) What to do now (prioritized checklist that actually works)
Eurail advises updating your Rail Planner password and being vigilant about suspicious communications. Below is a step-by-step plan that follows that guidance but puts actions in the right order (highest impact first).
Lock down your email first
Your email is the reset channel for most services. If a scammer gets your email, they can reset everything else. Change your email password, turn on MFA, and review recovery options (backup email/phone).
- Use a long, unique password (password manager recommended).
- Turn on MFA (authenticator app or passkeys if available).
- Check for unexpected forwarding rules and unfamiliar logged-in devices.
Change your Rail Planner / Eurail / Interrail password
Eurail explicitly recommends updating the Rail Planner password as a precaution. If you reused that password anywhere else, assume it is compromised and change it everywhere.
- Do not click “reset” links from messages. Open the app or type the official site yourself.
- Use a new password that you have never used before.
- If the service supports MFA, enable it.
Turn on stronger sign-in protections
MFA reduces the chance that a stolen password becomes a full account takeover. Prefer app-based MFA or passkeys over SMS when possible.
- Enable MFA on email, banking, travel accounts, and social media.
- Use a password manager to store unique credentials.
- Consider passkeys for major accounts that support them.
Monitor your bank accounts and set alerts
Eurail advises customers to monitor bank accounts for unusual transactions. Even if Eurail says it does not store bank/credit card info for direct purchases, you should still assume scammers will try “refund” and “verification” fraud.
- Turn on push alerts for transactions and new payees/beneficiaries.
- Watch for small “test” charges or transfers (often a precursor to larger fraud).
- If you are a DiscoverEU traveler, take IBAN-related vigilance seriously.
Assume travel-themed phishing will target you
Eurail warns to remain vigilant for suspicious requests for personal information. The most dangerous messages are urgent and “administrative,” not obviously scammy.
- Never share passport details or one-time codes over chat or email.
- Do not install “verification apps” or “support tools.”
- When in doubt, contact support through official channels you navigate to yourself.
Optional but smart: tighten your digital footprint for the next 30 days
- Review recent password reuse across services and rotate anything shared with your Eurail/email password.
- Harden your phone number against SIM swaps: add a carrier PIN if your carrier supports it.
- Update your devices and browsers (phishing often pairs with exploit kits and malicious attachments).
8) If you’re traveling soon (next 30 days), do these extra steps
Scammers love timing. If they suspect you are about to travel, they’ll send “urgent” messages right before departure when you are stressed and moving fast. Use this short travel-mode checklist:
Before you leave
- Take screenshots of your essential trip info inside official apps (offline access helps avoid panic-clicking links).
- Save official support pages as bookmarks (so you don’t Google “support” and land on ads or look-alike sites).
- Tell your travel companions: “We will never pay anything because of a random message.”
- Enable transaction alerts and low-balance alerts in your banking app.
While traveling
- Ignore “account locked” messages while in transit. Open the app yourself; do not use embedded links.
- If a “support agent” asks for passport details or codes, end the chat and contact official support.
- Be cautious with public Wi-Fi. If you must use it, avoid logging into sensitive accounts.
- Keep your phone locked and your SIM protected (PIN if appropriate).
The goal is not paranoia; it’s reducing the chance that urgency overrides judgment. Most real travel problems can be resolved without clicking a random link sent to you.
9) Special guidance for DiscoverEU travelers
If you traveled through the EU’s DiscoverEU program, your threat model is slightly different because the EU notice warns that data may include passport/ID information or photocopies, IBAN, and health data (where applicable). Even if there is “no evidence of misuse” at a given moment, that can change quickly once datasets circulate.
DiscoverEU priority actions
- Bank monitoring: turn on alerts for transfers and new beneficiaries; if you see suspicious activity, contact your bank immediately.
- Identity vigilance: treat any “re-verification” request as suspicious unless it comes through official channels you initiate.
- Phishing resistance: assume messages may reference the DiscoverEU program by name to sound authentic.
- Know the official contact: the EU notice provides a DiscoverEU security contact email for affected users.
About IBAN and “refund” scams
IBAN information is not the same as a card number, but it can still be used to make scams believable: “We need to confirm your IBAN for reimbursement” is a classic tactic. Your safest move: never provide bank details via unsolicited messages. If you need to confirm anything, navigate to official EU/Eurail pages yourself and use the contact methods listed there.
Health data: why it matters
Health-related data can be used for targeted extortion attempts and social engineering: scammers may claim they have “sensitive medical details” to pressure victims into paying. If you receive such a message, do not engage. Save evidence, report it, and seek official guidance.
10) How to spot Eurail/Interrail phishing (and what to do instead)
Eurail states it will never request sensitive information through unsolicited contact. That single line defeats most scams—if you apply it consistently.
Red flags
- Urgency: “within 30 minutes” / “last warning” / “final notice.”
- Link pressure: “confirm now” with a shortened link.
- Request for passport details, photocopies, bank details, or one-time codes.
- Payment to “reactivate” or “unlock” your pass.
- Support moves you to WhatsApp/Telegram and asks for verification info.
Safer alternatives
- Open the Rail Planner app directly (not via a link).
- Type the official website yourself (or use your own bookmarks).
- Use official support channels listed on the company’s site.
- If you are DiscoverEU: use the official EU contact points from the Youth Portal notice.
If you clicked a suspicious link
- Change your email password immediately (and enable MFA).
- Change your Rail Planner/Eurail password.
- Check for email forwarding rules and unfamiliar devices.
- Monitor your bank account and consider calling your bank for extra checks.
11) What Eurail and the EU say they’re doing
Eurail (official incident update)
- Secured systems and initiated an investigation with external cybersecurity specialists and legal advisors.
- Monitoring dark web forums and investigating scope and impact.
- Reported the incident to relevant data protection authorities and is notifying authorities outside the EU as required.
- Plans to inform customers whose data may have been accessed and published where contact details are available.
European Commission / DiscoverEU (Youth Portal notice)
- Following the ongoing investigation and working to ensure mitigation measures are taken.
- Warned DiscoverEU travelers about possible data categories and likely risks (phishing, unauthorized access, identity theft).
- Recommended standard breach precautions: password changes, vigilance, and bank monitoring.
What to watch next: further official updates that clarify how many customers were affected and which specific data categories were included. Treat “new details” as provisional unless they come from official notices or clearly documented forensic findings.
12) FAQ (fast answers)
Was my credit card data leaked?
Eurail’s official statement says that if you purchased your pass from Eurail B.V., it does not store bank or credit card information. That reduces risk from direct payment data exposure, but you should still watch for phishing and “refund” scams.
Does Eurail store passport scans?
Eurail states it does not keep a visual copy of your passport for direct purchases. For DiscoverEU travelers, the EU notice says passport/ID information or photocopies may be involved (where applicable), so treat DiscoverEU as a separate, higher-sensitivity category.
I used Interrail, not Eurail. Am I included?
Public reporting describes the incident as impacting Eurail B.V. systems connected to Eurail/Interrail customers. If you were issued a pass, or purchased via partner channels, follow the same precautions: password changes, MFA, and phishing vigilance.
What is the most likely harm to travelers?
The highest-probability risk is phishing and social engineering: messages that look official and use personal/travel context to trick you into sharing credentials, codes, or money. Identity fraud risk increases when multiple identifiers are exposed.
Should I replace my passport?
Don’t jump to drastic steps without evidence your specific passport data is exposed and being misused. Start with strong account security, MFA, and scam vigilance. If you receive credible notice that your passport details (or photocopy) were involved and you see signs of identity fraud, contact the appropriate authorities for your country and follow their guidance.
How do I verify if a message is real?
Do not use links in the message. Open the Rail Planner app or type the official site yourself. Use contact methods listed on official pages. Eurail also states it will never request sensitive information through unsolicited contact.
Sources + update log
Primary sources (most important)
- Eurail official: Data security incident (updated Feb 13, 2026)
- European Youth Portal: DiscoverEU data security incident (updated Jan 13, 2026)
Secondary reporting (context + threat-actor claim summaries)
- BleepingComputer (Feb 16, 2026)
- SecurityWeek (Feb 17, 2026)
- Cybernews (Feb 18, 2026)
- TechRadar (Feb 17, 2026)
Update log
- Feb 20, 2026: Post refreshed for clarity on “confirmed vs claimed” and expanded traveler checklists and FAQ.
- Feb 18, 2026: Reporting spike around threat-actor “1.3TB” claims and Telegram samples.
- Feb 13, 2026: Eurail official update: data offered for sale + sample posted on Telegram.
- Jan 13, 2026: EU DiscoverEU notice updated with potential data categories and mitigation guidance.