Amtrak 2026.0 Data Breach
ObscureIQ Breach Intelligence
High SeverityWebsite / service breach
Amtrak Passenger Rail Service Breach (2026): 2.1 Million Customer Records Including Travel History & Home Address Exposed via ShinyHunters
National passenger rail service operator.
Verified by ObscureIQ Intelligence
66/100Breach Risk Index
13Data Value
80Market Recency
82dSince Breach
Breach Intelligence Summary
Entity: Amtrak · Actor: ShinyHunters · Sources: 2 references
Attack: Credential Theft
Profile: Company · Transportation and rail services · National passenger rail operator · USA
Timeline: Breach (2026-04-03) · Indexed (Apr 17, 2026) · Year (2026.0)
Exposure: 2.1M records · 4 fields: Email Address, Full Name, Physical Address, Support Record
Status: Confirmed
Executive Summary
Amtrak, the U.S. national passenger rail operator, suffered a data breach in April 2026 attributed to the cybercriminal group ShinyHunters. The group is known for large-scale data theft followed by extortion attempts, and the data was publicly released after Amtrak did not meet ransom demands. The published dataset contained over 2 million unique email addresses along with customer names, physical addresses, and customer support records. The breach was reportedly executed against Amtrak's Salesforce instance and is part of a broader ShinyHunters / Scattered Lapsus$ Hunters campaign that has compromised at least 15 organizations through SSO-targeted vishing since 2025. This is Amtrak's third publicly disclosed customer-data incident in six years, following Guest Rewards credential-stuffing incidents in 2020 and 2024 — though, unlike those, the 2026 breach involves direct compromise of an Amtrak-controlled platform.
ObscureIQ assessment: Travel data combined with contact information enables targeted phishing, fake refund or compensation scams, loyalty-point theft, and pretexting attacks impersonating Amtrak support. Trip itineraries and support history also create elevated risk of physical-location targeting and believable customer-service impersonation.
Breach Impact
In April 2026 ShinyHunters claimed responsibility for a breach of Amtrak systems, with a dataset of approximately 2.1 million unique email addresses subsequently circulated. The exposed data included names, email addresses, physical addresses, and customer support records, with support tickets reportedly containing travel habits and preferences. The threat actor initially claimed 9.4 million records were stolen and demanded ransom; when payment was not made the data was published. The breach was reportedly executed via compromise of Amtrak's Salesforce instance, consistent with the ShinyHunters 2025–2026 vishing-driven SSO and CRM exfiltration campaign.
About Amtrak
Amtrak, officially the National Railroad Passenger Corporation, is the United States' national passenger rail service. The company is a federally chartered, government-owned corporation founded in 1971 and headquartered in Washington, D.C. Amtrak operates intercity rail service in 46 U.S. states and three Canadian provinces, with a network of more than 500 stations and 21,000 miles of track. It employs approximately 21,700 people and generates roughly $3.6 billion in annual revenue.
Why They Hold Your Data
Passenger rail operators collect customer identity, contact details, ticket purchase data, loyalty program information, support records, and trip itineraries across booking, fulfillment, and customer-service workflows.
Recent Developments
Amtrak continues to operate as the U.S. national passenger rail service. The April 2026 breach was its third publicly disclosed customer-data incident in six years, following Guest Rewards credential-stuffing incidents in 2020 and 2024. Unlike those, the 2026 incident involved direct compromise of an Amtrak-controlled platform (its Salesforce environment) via the broader ShinyHunters / Scattered Lapsus$ Hunters vishing campaign that has hit at least 15 organizations since 2025.
Data Points Exposed
4 verified field types
Email Address
Full Name High
Physical Address High
Support Record
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:High
Primary downstream threats:
- Targeted phishing campaigns using exposed email addresses
- Pretexting attacks impersonating Amtrak support using prior trip and complaint history
- Doxxing risk from physical address exposure
- Loyalty-point theft via credential stuffing against Amtrak Guest Rewards
- Refund and compensation scams referencing real travel history
Threat vectors:
- Phishing, credential stuffing & account takeover
- Name-based social engineering
- Geolocation & account flagging
- Physical stalking, mail fraud & identity verification
- Pretexting via travel history & support records
Threat Actor: ShinyHunters
ShinyHunters
Credential Theft
Attribution and method are based on available breach intelligence. Reported attack vector: Credential Theft.
Recommended Actions
If you believe your information may be included:
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the Amtrak breach?▾
Amtrak, the U.S. national passenger rail operator, suffered a data breach in April 2026 attributed to the cybercriminal group ShinyHunters. The group is known for large-scale data theft followed by extortion attempts, and the data was publicly released after Amtrak did not meet ransom demands. The…
What data was exposed?▾
Verified fields include Email Address, Full Name, Physical Address, Support Record.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation