Personal Data Protection Board Declared a Data Breach at Eurail B.V. Affecting 8 Thousand 823 Turkish Resident Passengers
It was reported that the identity, passport, contact and travel information of 8 thousand 823 customers residing in Turkey who purchased train tickets were affected in the cyber attack on the systems of Netherlands-based Eurail B.V., which started on December 26, 2025 and was detected on January 5, 2026.
The Personal Data Protection Authority published a public notice regarding the data breach at Eurail B.V.
The relevant provision of the law states: "In case the processed personal data is obtained by others through illegal means, the data controller shall notify the relevant person and the Board of this situation as soon as possible."
Cyber Attack Started on December 26
In the notification sent to the Board, it was stated that Eurail B.V., established and operating in the Netherlands, uses an agency distribution model for the sale of travel tickets around the world.
It was reported that the violation started on 26.12.2025 and was detected on 05.01.2026.
Passport and Travel Information Affected
Personal data affected by the breach;
Within the scope of contact data, address and place of residence, e-mail address and telephone number;
It was stated that 8 thousand 823 people residing in Turkey were affected by the violation, and the relevant group of people were customers who purchased train tickets.
Şirketin, ihlale ilişkin teknik inceleme ve ek araştırmalarının devam ettiği kaydedildi. İlgili kişilerin privacyhelp@eurrail.com e-posta adresi üzerinden bilgi alabilecekleri duyuruldu.
Announcement Decision on the Website from the Board
It was announced that with the Decision of the Personal Data Protection Board dated 27.01.2026 and numbered 2026/103, it was decided to announce the data breach notification on the Authority's website.
Kaynak: Beykozun Sesi
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Angry
0
Sad
0
Wow
0
