Loading story…
UK train operator LNER has disclosed a data breach involving a third-party supplier, resulting in the exposure of customer contact details and information about previous journeys. No financial or password data was compromised, and train operations remain unaffected. Customers are advised to be vigilant against phishing attempts and unsolicited communications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
5 references tracked. Mallory keeps watching after this page renders.
bitdefender.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Eurail B.V.** confirmed that customer data stolen in a previously disclosed breach is now being **offered for sale on the dark web**, with a **sample dataset published on Telegram**. The Netherlands-based rail pass operator (Eurail/Interrail), which also serves travelers in the European Commission’s **DiscoverEU** program, said it is still investigating the scope and impact and has engaged external cybersecurity and legal experts while working to determine which records and how many customers are affected. Reportedly exposed data may include **order and reservation details** and sensitive personal information such as names, dates of birth/age, contact details (email, phone, address, country of residence), travel companion information, and in some cases **passport/ID data (including photocopies), passport numbers and expiry dates**, **bank account references (IBAN)**, and **health-related data**. Eurail said it has notified relevant data protection authorities under **GDPR** and plans to issue individual notifications to impacted customers; it also advised users to be alert for **phishing/scams** and to update passwords (including the *Rail Planner* app) where credentials may have been reused.
Jun 29, 2026
**Eurail (Interrail in the EU)** confirmed a data breach in which customer information was stolen, with affected customers notified via email after the company initially posted a notice about the incident. Reported exposed data includes **names, dates of birth, gender, email addresses, home addresses, phone numbers, and passport details** (number, issuing country, and expiration date). Eurail stated that it is monitoring for misuse and warned customers about downstream risks such as **phishing, spoofing, unauthorized account access, and identity theft**, and it set up customer support/FAQ guidance. For travelers who obtained passes via the EU’s **DiscoverEU** program, the European Commission issued a separate notice indicating potentially broader exposure beyond Eurail’s standard dataset, including **ID document copies, bank account reference details (e.g., IBAN/bank reference numbers), and health data**. Eurail indicated that customers who purchased directly did not have visual copies of passports stored, but DiscoverEU participants may have had such copies processed/stored as part of program requirements, increasing the sensitivity of the compromised data set.
Jun 29, 2026
London Hydro, a Canadian utility serving more than 160,000 customers, disclosed a security incident that may have exposed customer personal and account information. The potentially affected data includes names, home and service addresses, email addresses, phone numbers, account and billing numbers, pricing plans, contract start dates, and meter information. The company said banking details, payment card data, dates of birth, and government-issued identification numbers were not involved, and it has begun notifying affected individuals. The utility has not disclosed how the intrusion occurred, whether data was exfiltrated, how many customers were affected, or whether ransomware, extortion, third-party systems, or operational technology played a role. London Hydro warned that the exposed account details could make phishing, impersonation, and fraudulent billing scams more convincing, and advised customers to watch for suspicious communications, unexpected bills, unfamiliar account activity, and requests to change payment arrangements.
Jun 29, 2026