Amtrak Passenger Rail Service Breach (2026): 2.1 Million Customer Records Including Travel History & Home Address Exposed via ShinyHunters

Breach Summary

Amtrak, the U.S. national passenger rail operator, suffered a data breach in April 2026 attributed to the cybercriminal group ShinyHunters. The group is known for large-scale data theft followed by extortion attempts, and the data was publicly released after Amtrak did not meet ransom demands. The published dataset contained over 2 million unique email addresses along with customer names, physical addresses, and customer support records. The breach was reportedly executed against Amtrak's Salesforce instance and is part of a broader ShinyHunters / Scattered Lapsus$ Hunters campaign that has compromised at least 15 organizations through SSO-targeted vishing since 2025. This is Amtrak's third publicly disclosed customer-data incident in six years, following Guest Rewards credential-stuffing incidents in 2020 and 2024 — though, unlike those, the 2026 breach involves direct compromise of an Amtrak-controlled platform.

About Amtrak

Amtrak, officially the National Railroad Passenger Corporation, is the United States' national passenger rail service. The company is a federally chartered, government-owned corporation founded in 1971 and headquartered in Washington, D.C. Amtrak operates intercity rail service in 46 U.S. states and three Canadian provinces, with a network of more than 500 stations and 21,000 miles of track. It employs approximately 21,700 people and generates roughly $3.6 billion in annual revenue.

Why They Hold Your Data

Passenger rail operators collect customer identity, contact details, ticket purchase data, loyalty program information, support records, and trip itineraries across booking, fulfillment, and customer-service workflows.

Recent Developments

Amtrak continues to operate as the U.S. national passenger rail service. The April 2026 breach was its third publicly disclosed customer-data incident in six years, following Guest Rewards credential-stuffing incidents in 2020 and 2024. Unlike those, the 2026 incident involved direct compromise of an Amtrak-controlled platform (its Salesforce environment) via the broader ShinyHunters / Scattered Lapsus$ Hunters vishing campaign that has hit at least 15 organizations since 2025.

Data Points Exposed

Breach Impact

In April 2026 ShinyHunters claimed responsibility for a breach of Amtrak systems, with a dataset of approximately 2.1 million unique email addresses subsequently circulated. The exposed data included names, email addresses, physical addresses, and customer support records, with support tickets reportedly containing travel habits and preferences. The threat actor initially claimed 9.4 million records were stolen and demanded ransom; when payment was not made the data was published. The breach was reportedly executed via compromise of Amtrak's Salesforce instance, consistent with the ShinyHunters 2025–2026 vishing-driven SSO and CRM exfiltration campaign.

Exploitation & Downstream Threats

• Targeted phishing campaigns using exposed email addresses | • Pretexting attacks impersonating Amtrak support using prior trip and complaint history | • Doxxing risk from physical address exposure | • Loyalty-point theft via credential stuffing against Amtrak Guest Rewards | • Refund and compensation scams referencing real travel history

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).