Amtrak Data Breach

What happened?

In April 2026, the hacking group ShinyHunters claimed they had breached Amtrak . The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly. They subsequently published the alleged data which contained over 2M unique email addresses along with names, physical addresses and customer support records.

When did it happen?

The breach date in the public record is April 3, 2026. The record was added to the catalogue on April 17, 2026 and last updated there on April 17, 2026.

What information was reported as exposed?

• Email addresses
• Names
• Physical addresses
• Support tickets

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Amtrak or used amtrak.com around April 3, 2026. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.