Amtrak Data Breach: Millions Exposed Online

A data breach potentially affecting over 2.1 million Amtrak customer accounts has been reported, with details appearing on Have I Been Pwned on April 17, 2026. The exposed information includes customer names, email and physical addresses, and records of support interactions. Some estimates suggest the total number of affected records could be as high as 9.4 million, though this has not been confirmed by Amtrak.

The breach is attributed to the group ShinyHunters, known for targeting cloud-based customer relationship management (CRM) systems. Attackers often exploit weak access controls or compromised credentials on these platforms, rather than breaching internal networks. The compromised data, particularly support history, provides context for crafting sophisticated phishing attacks.

Risks extend beyond account access to impersonation, where attackers can use personal details to build trust and deceive individuals into sharing more information or authorizing transactions. Travelers are advised to change reused passwords, enable two-factor authentication, and be wary of communications referencing past travel experiences.

Amtrak has not yet commented on the full scope of the breach. This incident underscores broader concerns about data security in cloud-dependent companies, as attackers increasingly target concentrated customer data on SaaS platforms. Consumers are urged to check Have I Been Pwned and take protective measures like using password managers and antivirus software.