Amtrak Data Breach

In April 2026, ShinyHunters gained access to Amtrak's customer database and exfiltrated 2.1 million records. The stolen data included customer names, email addresses, phone numbers, and Amtrak Guest Rewards loyalty program information. Amtrak confirmed the breach in mid-April 2026. The breach was listed on Have I Been Pwned on April 17, 2026.

Amtrak is the United States' national passenger railroad service, operating over 300 trains daily across 46 states and carrying over 30 million passengers annually.

The attack followed ShinyHunters' established methodology of social engineering to compromise credentials for bulk data extraction.

ShinyHunters is a prolific cybercriminal/extortion group.

Aliases

• SH

Attribution sources

• ShinyHunters leak site
• BleepingComputer
• Have I Been Pwned
• Amtrak statements

Countries affected

• United States

Data types

• PII
• Names
• Email addresses
• Phone numbers
• Loyalty program data

Reputational damage to a federally operated transportation service.

Public reaction

Concern over security of federally operated transportation customer data.

Political impact

Increased scrutiny of cybersecurity practices at federally operated transportation agencies.

Significance

Demonstrates vulnerability of federal transportation infrastructure to criminal extortion groups.

Publishing organisations

• BleepingComputer
• Have I Been Pwned

Related events

• 2026-charter-communications-shinyhunters-breach

Amtrak confirmed the breach and notified affected customers.

Official documents

• Amtrak data breach notification

References

1. [1]BleepingComputer: Amtrak data breach coverage
2. [2]Have I Been Pwned - Amtrak listing