European travel company Eurail has disclosed a data breach impacting customers’ personal, order, and reservation information.
The incident, the company says, impacted all customers who were issued a Eurail pass, as well as those who made a seat reservation with the company.
“This includes customers who may have purchased a Eurail or Interrail Pass through one of our partner channels or distributors,” Eurail said.
The rail pass provider does not have an exact number of affected individuals yet, but has been investigating the incident with the European Commission, as participants in the DiscoverEU program have been impacted as well.
The compromised information, Eurail said, includes basic identity and contact information, as well as passport information.
In line with the European Union GDPR requirements, the company reported the incident to the data protection authority.
According to the European Commission, for Eurail customers part of the DiscoverEU programme, the stolen data includes names, dates of birth, addresses, email addresses, phone numbers, passport and ID information, health information, and IBANs.
“There is currently no evidence that the data has been misused or publicly disclosed. This is consistently being monitored by external cybersecurity specialists,” Eurail said.
Potentially affected individuals should be vigilant against phishing, spoofing, identity theft, and unauthorized access attempts, the European Commission said.
Eurail told the Commission that it secured the affected systems, rotated credentials, and improved monitoring. The company is working with security experts and the relevant authorities in investigating the data breach.
Related: Robo-Advisor Betterment Discloses Data Breach
Related: After Goldman, JPMorgan Discloses Law Firm Data Breach
Related: 377,000 Impacted by Data Breach at Texas Gas Station Firm
Related: Dozens of Major Data Breaches Linked to Single Threat Actor
