1. [News](/news) 2. Amtrak data breach exposes over 2 million customer records # Amtrak data breach exposes over 2 million customer records A data breach involving Amtrak was reported in April 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team April 30, 2026 Table of Contents * [What happened in the Amtrak data breach?](#what-happened-in-the-amtrak-data-breach) * [Who is behind the incident?](#who-is-behind-the-incident) * [Impact and risks for Amtrak customers](#impact-and-risks-for-amtrak-customers) * [How to protect against similar security incidents](#how-to-protect-against-similar-security-incidents) ## Key facts: Amtrak data breach * Date discovered April 17, 2026 * Date reported April 29, 2026 * Target entity Amtrak * Source of breach Ransomware group ShinyHunters * Data types Email addresses, names, physical addresses, customer support records * Status Confirmed; reported on April 29, 2026. * Severity Medium; exposure of personal contact details and support history increases risk of targeted phishing. ## What happened in the Amtrak data breach? Amtrak (amtrak.com), a major passenger railroad service, was involved in a data breach reported on April 29, 2026. The incident came to light after a dataset containing customer information surfaced on the breach notification site Have I Been Pwned. The threat actor group ShinyHunters is reportedly responsible for the attack, which appears to have targeted cloud-based customer management systems. The breach, initially identified on April 17, 2026, revealed over 2.1 million unique accounts with exposed data including names, email addresses, physical addresses, and customer support records. While Amtrak has not confirmed the full scale, estimates suggest the total number of records involved could reach as high as 9.4 million. The medium-severity rating reflects the exposure of personally identifiable information (PII) that could be leveraged for fraudulent activities. Typical risks for incidents of this nature include identity theft and credential stuffing. ## Who is behind the incident? The attack has been attributed to ShinyHunters, a notorious threat actor group known for targeting high-profile companies and their cloud-based storage systems. Active for several years, the group typically focuses on stealing large datasets to sell on dark web forums or to extort victims. ShinyHunters has a history of compromising cloud environments, often through credential theft or exploiting misconfigurations. Their campaigns frequently result in the exposure of millions of user records across various industries. The group’s involvement in the Amtrak incident highlights ongoing concerns regarding the security of customer data stored in cloud platforms. ## Impact and risks for Amtrak customers For Amtrak customers, the primary risk involves the potential misuse of personal information such as names and physical addresses. Exposed email addresses and customer support records are particularly valuable for social engineering and highly targeted phishing campaigns. Attackers may use the specific details found in support records to craft convincing messages that trick individuals into revealing further sensitive data or login credentials. There is also a risk of credential stuffing if users reuse the same passwords across different services. Typical outcomes of such breaches include an increase in spam and fraudulent contact attempts. Impacted individuals should monitor their accounts for suspicious activity and consider updating their security settings. Implementing multi-factor authentication (MFA) and using unique passwords for every service are essential protective actions. Transparency from the affected organization is crucial in helping customers mitigate these risks effectively. ## How to protect against similar security incidents Following the Amtrak data breach involving over 2 million records, customers should take immediate steps to secure their personal information and monitor for signs of identity theft. * **Enhance account security with MFA.** Enable multi-factor authentication (MFA) on your Amtrak account and all associated email accounts. Use phishing-resistant MFA methods, such as hardware security keys or authenticator apps, rather than SMS-based codes. * **Monitor for targeted phishing.** Be vigilant regarding unsolicited emails or mail sent to your physical address that reference your Amtrak travel history. Avoid clicking links or downloading attachments from unknown sources, even if they appear to come from official customer support. * **Implement continuous security monitoring.** Utilize attack surface management tools to identify and close security gaps in cloud-based environments. Monitor the dark web for leaked credentials to ensure compromised data is not being used to gain unauthorized access to other systems. > Proactive security measures and constant vigilance are the best defenses against the long-term risks associated with data exposure. ## Frequently asked questions ### What happened in the Amtrak security breach? ShinyHunters claimed responsibility for a security attack on Amtrak (amtrak.com) in April 2026. The incident was first reported on April 29, 2026 after a dataset was discovered on Have I Been Pwned. ### When did the Amtrak breach occur? The Amtrak breach was publicly reported on April 29, 2026. ShinyHunters referenced the incident around April 17, 2026, when the data was added to Have I Been Pwned, but the attack may have occurred earlier. ### What data was exposed? The types of data involved in the Amtrak incident include names, email addresses, physical addresses, and customer support records. While 2.1 million accounts are confirmed, reports suggest up to 9.4 million records may be involved. ### Is my personal information at risk? If you interacted with Amtrak, there’s a possibility your personal information could be affected. This incident involves contact details and support history, which could be used for phishing or identity theft. Stay alert for updates and take precautionary measures to secure your accounts. ### What steps should companies take after being breached? Organizations typically respond by securing affected cloud systems, notifying impacted customers, and reviewing data management practices. Deploying attack surface management and continuous monitoring can help prevent similar unauthorized access in the future. ## Is your organization exposed to a similar risk? UpGuard continuously monitors vendors for exposed credentials and infrastructure risk, so you can catch the next breach before it becomes a headline. [Start your free trial](https://cyber-risk.upguard.com/register/trial) Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](https://www.upguard.com/instant-security-score?) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.