‘I wanted to travel around Europe – now my passport is being sold on the dark web’
People’s names, emails and even passports are being flogged on the dark web after a European railway company was hacked.
Eurail, which provides the Interrail pass, revealed in January that cyber criminals targeted it and the EU’s DiscoverEU program the month before.
The firm told impacted riders on Tuesday that some of the stolen data is being flogged on the dark web, the vast underbelly of the internet, according to an email seen by Metro.
A sample dataset, which does not include people’s data, was also copied to Telegram, popular among drug dealers and extremists, Eurail found.
The email said: ‘We have secured our systems and are continuing to work with external cybersecurity specialists and monitoring the dark web.
‘We also remain in contact with the relevant authorities’
When asked by Metro, Eurail said it is still investigating how many people were impacted by the breach.
Though the rail firm reported to the Oregon Department of Justice in March that the personal information of 308,777 travellers was exposed.
It added in the email: ‘Criminals may attempt to misuse your data. We therefore advise you to remain extra vigilant for unexpected or suspicious phone calls, emails, or text messages asking for personal information.
‘If in doubt, never share your information with someone who contacts you unexpectedly or claims to work for Eurail.’
What Interrail personal data was stolen?
The Interrail pass covers a month of free travel on most slow trains across Europe and discounted journeys on high-speed trains.
The pass has long been the go-to for young people seeking a coming-of-age adventure of backpacking around Europe.
But crooks pried open the company’s customer database and made off with personal information, including:
- names
- email addresses
- dates of birth
- country of residence
- passport/ID copies.
According to the Cyber Security Incident Database, hackers stole 1.3 terabytes of information from Eurail’s Amazon S3 storage, Zendesk support system and its repository on the open-source collaboration platform GitLab.
They claimed they made off with ‘millions’ of customers’ data, according to Cybernews.
A screengrab the outlet obtained of the hackers’ Telegram channel shows them threatening to make the dataset public if an ‘offer’ isn’t made.
The cybersecurity news outlet reported that travellers’ info was also being sold on marketplaces on the surface web, the layer most people surf.
‘Eurail says they “take security seriously” – clearly not’
Eurail’s update was of little reassurance to travellers, they told Metro, who worry that their passports are going to the highest bidder on the dark web.
One rider, who did not wish to be named, bought an Interrail ticket for July to travel with their partner.
‘I feel uncomfortable knowing that my personal details, especially my passport details and address, are on the dark web,’ they said.
‘Information like my email and passwords are less surprising as these are likely to have appeared from data breaches in the past.’
Another backpacker said: ‘Eurail finished the email with “we take the security of your data seriously” – well, clearly not.’
All riders expressed unease about their future journeys, as well as scepticism about how much Eurail is supporting them.
‘I’ve asked for more advice as to whether I need to consider a new passport, etc., as the advice and information around this was very limited,’ a third passenger said.
‘Seems they’ve been quite open with what’s happened, but I’m not clear who copied the data from their databases. I’m also quite lost on what to do regarding my passport.’
Customers who bought a travel pass directly from Eurail or Interrail do not have a visual copy of their passports stored on company systems.
But those who purchased a pass through the DiscoverEU program, an Erasmus-funded initiative, do.
All our data has a dark web price tag, says expert
Dark websites allow both sides of an online interaction to hide their identity and location from each other and the police.
This is why marketplaces flogging people’s personal documents have thrived, the cybersecurity company NordVPN told Metro.
NordVPN found digital copies of British passports, including images and scans, were typically listed for about £26.
Physical passports from certain countries, such as the US and Italy, easily go for more than £1,1000.
These documents are vital for criminals who want to impersonate people and hijack their accounts.
Marijus Briedis, chief technology officer at NordVPN, said all our data has a price tag on the dark web.
‘Dark web criminals are no longer fishing through your bins for ribbons of shredded documents,’ said Briedis. ‘Digital copies of documents are readily available, much cheaper and easier to trade.’
Eurail told Metro that it is ‘actively in the process of notifying affected customers’, including telling them the specifics of the swiped data.
‘Upon discovering the incident, we immediately took steps to secure our systems and engaged external cybersecurity specialists and legal advisors,’ a spokesperson said.
‘We have implemented additional security measures and continue to monitor our systems closely. Preventing and mitigating any potential impact on our customers remains our highest priority.
The firm can not disclose a country-by-country breakdown at this stage.
They added: ‘We regret any concern this incident may cause and remain committed to protecting our customers’ data.’
Get in touch with our news team by emailing us at webnews@metro.co.uk.
For more stories like this, check our news page.