Cyber Incident Victim: Rail Europe North America
Date:
Nov 2017
Location:
United States of America
Summary
A North American rail ticket booking service experienced a three-month security breach involving credit card-skimming malware on its website, compromising payment card details including numbers, expiration dates, and verification codes alongside personal information such as names, addresses, contact details, and in some cases account credentials. The company responded by replacing compromised systems with verified secure code, resetting passwords, and renewing security certificates, though the intrusion method remained unspecified. While the exact number of affected customers was undisclosed, the service reported over five million users during the prior year.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Rail Europe North America experienced a data breach involving unauthorized access to its online booking systems between late November 2017 and mid-February 2018. Attackers deployed credit card-skimming malware on the company's website, compromising payment card details and personal information of customers who purchased European train tickets during this three-month period. The breach was disclosed through a notification letter filed with the California attorney general's office in 2018, though the exact discovery date remains unspecified in public reporting. Stolen data included complete payment card information such as card numbers, expiration dates, and verification codes, along with customers' names, genders, delivery/invoicing addresses, phone numbers, and email addresses. Some compromised accounts also contained usernames and passwords used for the Rail Europe platform. The company acknowledged that this combination of stolen data provided sufficient elements for fraudulent transactions.
Rail Europe responded by replacing and rebuilding compromised systems using verified safe code, though the initial attack vector remained undisclosed. The company implemented password resets for affected accounts and renewed security certificates following the breach containment. While California breach notification laws required disclosure for incidents affecting more than 500 state residents, Rail Europe declined to specify the total number of impacted customers when questioned, stating only that their platform served over five million customers in 2017. The incident exposed payment card data alongside sufficient personal identifiers to enable financial fraud, though no specific fraud cases were directly attributed to the breach in available reports. System restoration efforts focused on eliminating the card-skimming malware without public discussion of additional security enhancements beyond infrastructure replacement and credential rotation.