HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountCredentialsLowContained

Search & Book on Rail Europe

bd_26d5d9f1a5bd5eac · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 16, 2018

Filed

May 30, 2018

To disclose

15 weeks

Affected

18state residents only

Confidence

64%

Full breach record for Search & Book on Rail Europe →

Rail Europe disclosed a data breach where unauthorized access occurred from June 15, 2017, to February 16, 2018. The incident compromised customer PII, including names, addresses, credit/debit card numbers (with CVV), and user credentials. Rail Europe engaged forensic experts, isolated compromised servers, rebuilt systems, and offered 12 months of identity theft protection to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 246 days

discovery → filing · 15 weeks / 103 days

Jun 15, 2017

Begins

Feb 16, 2018

Discovered

May 30, 2018

Filed

vs. sector median

+7 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed18 affectedView incident

Name: Search & Book on Rail Europe
norm: search book on rail europe
Domain: raileurope.com

Name: Search & Book on Rail Europe
norm: search book on rail europe
Domain: raileurope.com
Industry: Retail & Consumerllm

Discovered: Feb 16, 2018
Breach occurred: Jun 15, 2017 – Feb 16, 2018
Undetected for: 246 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 11, 2018
Affected individuals: 18state-resident count only
Data types: PIIIdentity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Cut off from the Internet all compromised servers on February 16, 2018
Engaged information security experts to assist with forensic analysis, system restoration and security hardening
Replaced and rebuilt all compromised systems from known safe code
Removed any potentially untrusted components
Changed passwords on all systems and applications
Renewed certificates
Hardened security controls
Provided notice to the credit card brands and our credit/debit card transaction processors
Offering identity theft protection services through ID Experts
Changes made: Replaced and rebuilt all compromised systems from known safe code
Removed any potentially untrusted components
Changed passwords on all systems and applications
Renewed certificates
Hardened security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Rail-Europe.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 30, 2018
Raw hash: 1fa4f02a6fe24acfd45dc3b71be8de4e3976a1aa2adc8416e5b95c60ec49d81d

Reporting entitySearch & Book on Rail Europe

Victim entitySearch & Book on Rail Europe

Incidentdiscovered Feb 16, 2018

Stated responseCut off from the Internet all compromised servers on February 16, 2018

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov