Amtrak 2026 Data Breach
ObscureIQ Breach Intelligence
High SeverityWebsite / service breach
Amtrak Passenger Rail Service Breach (2026): 2.1 Million Customer Records Including Travel History & Home Address Exposed via ShinyHunters
National passenger rail service operator.
Verified by ObscureIQ Intelligence
66/100Breach Risk Index
13Data Value
80Market Recency
82dSince Breach
Breach Intelligence Summary
Entity: Amtrak · Actor: ShinyHunters · Sources: 2 references
Attack: Social Engineering
Profile: Company · Transportation and rail services · National passenger rail operator · USA
Timeline: Breach (2026-04-03) · Indexed (Apr 17, 2026) · Year (2026)
Exposure: 2.1M records · 4 fields: Email Address, Full Name, Physical Address, Support Record
Status: Confirmed
Executive Summary
Amtrak, the U.S. national passenger rail operator, suffered a data breach in April 2026 attributed to the cybercriminal group ShinyHunters. The group is known for large-scale data theft followed by extortion attempts, and the data was publicly released after Amtrak did not meet ransom demands. The published dataset contained over 2 million unique email addresses along with customer names, physical addresses, and customer support records. The breach was reportedly executed against Amtrak's Salesforce instance and is part of a broader ShinyHunters / Scattered Lapsus$ Hunters campaign that has compromised at least 15 organizations through SSO-targeted vishing since 2025. This is Amtrak's third publicly disclosed customer-data incident in six years, following Guest Rewards credential-stuffing incidents in 2020 and 2024 — though, unlike those, the 2026 breach involves direct compromise of an Amtrak-controlled platform.
ObscureIQ assessment: Travel data combined with contact information enables targeted phishing, fake refund or compensation scams, loyalty-point theft, and pretexting attacks impersonating Amtrak support. Trip itineraries and support history also create elevated risk of physical-location targeting and believable customer-service impersonation.
Breach Impact
In April 2026 ShinyHunters claimed responsibility for a breach of Amtrak systems, with a dataset of approximately 2.1 million unique email addresses subsequently circulated. The exposed data included names, email addresses, physical addresses, and customer support records, with support tickets reportedly containing travel habits and preferences. The threat actor initially claimed 9.4 million records were stolen and demanded ransom; when payment was not made the data was published. The breach was reportedly executed via compromise of Amtrak's Salesforce instance, consistent with the ShinyHunters 2025–2026 vishing-driven SSO and CRM exfiltration campaign.
About Amtrak
Amtrak, officially the National Railroad Passenger Corporation, is the United States' national passenger rail service. The company is a federally chartered, government-owned corporation founded in 1971 and headquartered in Washington, D.C. Amtrak operates intercity rail service in 46 U.S. states and three Canadian provinces, with a network of more than 500 stations and 21,000 miles of track. It employs approximately 21,700 people and generates roughly $3.6 billion in annual revenue.
Why They Hold Your Data
Passenger rail operators collect customer identity, contact details, ticket purchase data, loyalty program information, support records, and trip itineraries across booking, fulfillment, and customer-service workflows.
Recent Developments
Amtrak continues to operate as the U.S. national passenger rail service. The April 2026 breach was its third publicly disclosed customer-data incident in six years, following Guest Rewards credential-stuffing incidents in 2020 and 2024. Unlike those, the 2026 incident involved direct compromise of an Amtrak-controlled platform (its Salesforce environment) via the broader ShinyHunters / Scattered Lapsus$ Hunters vishing campaign that has hit at least 15 organizations since 2025.
Data Points Exposed
4 verified field types
Email Address
Full Name High
Physical Address High
Support Record
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:High
Primary downstream threats:
- Targeted phishing campaigns using exposed email addresses
- Pretexting attacks impersonating Amtrak support using prior trip and complaint history
- Doxxing risk from physical address exposure
- Loyalty-point theft via credential stuffing against Amtrak Guest Rewards
- Refund and compensation scams referencing real travel history
Threat vectors:
- Phishing, credential stuffing & account takeover
- Name-based social engineering
- Geolocation & account flagging
- Physical stalking, mail fraud & identity verification
- Pretexting via travel history & support records
Threat Actor: ShinyHunters
ShinyHunters
Data theft / extortion group · confidence: High
Motivation: Financial extortion, data sale
ShinyHunters is a financially motivated data-theft and extortion group with a long history of stealing and selling large databases. The group evolved from breach resale and forum activity into SaaS-focused extortion, where stolen credentials, vishing, SSO abuse, and cloud data access are central. Google/Mandiant reporting has linked ShinyHunters-branded extortion to activity clusters involved in SaaS data theft and victim pressure. ShinyHunters is best understood as both a brand and a loose ecosystem, where operators, affiliates, and impersonators may overlap.
Recent activity: In 2026, Google Threat Intelligence Group reported an expansion of ShinyHunters-branded SaaS data-theft activity involving vishing, credential-harvesting sites, MFA capture, and subsequent extortion. Reporting tied related intrusion clusters such as UNC6661, UNC6671, and UNC6240 to the broader activity set. The shinyhunte.rs/BreachForums leak and later branding disputes also show internal conflict and reputation warfare around the ShinyHunters name. [source]
Attribution and method are based on available breach intelligence. Reported attack vector: Social Engineering.
Principal Risk Advisory
A travel or hospitality breach: itinerary, loyalty, and contact data supports pattern-of-life inference and travel-themed phishing. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
Recommended Actions
If you believe your information may be included:
- Treat the home address as exposed and review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and physical-targeting patterns, not generic credential monitoring).
Connected Breaches
This incident is part of the ShinyHunters / Scattered Lapsus$ Hunters - Salesforce (2025-26) campaign — 35 breaches in ObscureIQ’s dataset are attributed to this same campaign.
actor:ShinyHunters (67)vendor:Salesforce (54)campaign:ShinyHunters / Scattered Lapsus$ Hunters - Salesforce (2025-26) (35)
Counts reflect breaches attributed to the same campaign. A detailed cross-breach exposure map is available as part of an ObscureIQ engagement.
Frequently Asked Questions
What happened in the Amtrak breach?▾
Amtrak, the U.S. national passenger rail operator, suffered a data breach in April 2026 attributed to the cybercriminal group ShinyHunters. The group is known for large-scale data theft followed by extortion attempts, and the data was publicly released after Amtrak did not meet ransom demands. The…
What data was exposed?▾
Verified fields include Email Address, Full Name, Physical Address, Support Record.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation