Amtrak data breach: what happened and what to do

What happened

Have I Been Pwned (HIBP) dates the Amtrak breach to 3 April 2026 and added it to its database on 17 April 2026. It lists 2,147,679 accounts. Security press coverage in late April, including reports from UpGuard and TechRepublic, said a data set attributed to Amtrak had surfaced and that the ShinyHunters group was reportedly behind it, with attacks that reportedly targeted cloud-based customer management systems. Some outlets suggested the full data set could hold more records than HIBP's count. That larger number is an estimate and hasn't been verified.

At the time of those reports, Amtrak had not publicly confirmed the breach or answered media questions. The facts on this page therefore rest on HIBP's entry and on press coverage, not on a company notice. If Amtrak publishes one, its notice is the document to trust over this summary.

This is a separate event from the 2024 incident in which Amtrak Guest Rewards accounts were accessed. Details from that incident don't apply here.

What was exposed

HIBP lists four data types: email addresses, names, physical addresses and support tickets. Support tickets are free-text messages between customers and Amtrak's help desk. They can contain more than the form fields do: a trip, a complaint about a delay, a refund request, a mention of a family member or a disability accommodation. People write all kinds of things to customer service, and those details are now in someone else's hands.

HIBP does not list passwords, payment cards or government IDs for this breach.

What this lets criminals do

The most likely harm is a convincing scam. A criminal who has your name, your address and a past support request can send an email about a rail booking, refund or travel change that matches something that actually happened to you. A message that quotes a real trip detail is much more believable than a generic one.

Physical addresses add a second layer. Names and home addresses together are what people-search sites and mail-based scammers collect, and the data can be copied into other lists over time. Support-ticket text can also be used for social engineering, where a caller uses details you shared in the past to sound like a legitimate Amtrak agent.

Because no passwords are listed, you don't have an urgent account-takeover risk here. The risk is messages that exploit what Amtrak customers wrote and what the company knows about them.

Amtrak's response

Reporting in April stated that Amtrak had not confirmed the incident or responded to media inquiries. If that changes, expect a notice by email or post, and check spam folders for it.

Are you affected?

If you have booked a ticket, created an account or contacted customer service with an email address, check that address and any older ones on HIBP. Include addresses you used for family members' bookings. Then read your own past support messages if you still have them: whatever you wrote there, assume it could be quoted back to you in a scam.