Amtrak

Summary

Amtrak experienced a data exposure that placed a dataset containing over two million unique customer records on Have I Been Pwned, comprising email addresses, names, physical addresses and support interaction logs. The breach has been linked to the threat group ShinyHunters, which commonly targets cloud‑based customer relationship management platforms such as Salesforce to extract large volumes of data. The exposed support records enable attackers to reference specific travel details, increasing the likelihood of convincing impersonation‑based phishing attempts. While the company has not confirmed the full scope, separate estimates suggest the total number of affected records could be substantially higher.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On April 17, 2026, a dataset attributed to Amtrak was added to the Have I Been Pwned breach notification service, indicating that more than 2.1 million unique customer accounts had been exposed. The exposed information, as listed by Have I Been Pwned, included email addresses, full names, physical addresses, and customer support records. Separate, unverified reports suggested the total number of records could be as high as 9.4 million, although Amtrak has not confirmed this figure. The company has not publicly disclosed the full scope of the breach or provided a detailed statement regarding the incident.

Security researchers linked the exposure to the threat group ShinyHunters, which has a history of targeting cloud‑based customer relationship management platforms, particularly instances of Salesforce. According to the reporting, ShinyHunters typically gains access by exploiting weak access controls, misconfigured cloud settings, or compromised credentials rather than by penetrating internal corporate networks. Once inside the cloud environment, the actors are able to extract large volumes of data quickly and often demand payment before releasing the information publicly. The methods described align with the observed pattern of the Amtrak incident, wherein customer data was taken from a cloud‑hosted system.

The nature of the stolen data—combining basic contact details with customer support histories—enables attackers to craft highly personalized phishing messages that reference specific trips, refund requests, or service issues, thereby increasing the likelihood of recipients trusting the communication and interacting with malicious links or divulging further information. This impersonation risk represents the primary impact highlighted in the coverage, as attackers may pose as Amtrak support, travel partners, or financial institutions linked to bookings. Amtrak did not respond to requests for comment before the publication deadlines, and the articles contain no additional details about detection timelines, containment measures, or remediation actions undertaken by the company.

Sources

Sources available to members: 2 sources.