Amtrak Data Breach Exposes Over 2 Million Email Addresses in ShinyHunters Attack Earlier this month, U.S. rail operator Amtrak fell victim to a data breach attributed to the cybercriminal group ShinyHunters, with the compromised data surfacing this week. The exposed dataset includes over 2 million email addresses, along with names, physical addresses, and customer support ticket details. Approximately 80% of the leaked email addresses were already indexed in LinkedIn’s database, suggesting prior exposure in other breaches. The incident highlights the risks of overlapping personal data across platforms, as threat actors increasingly exploit aggregated information for targeted attacks. ShinyHunters, known for large-scale data theft and leaks, has previously targeted organizations across sectors, selling or distributing stolen records on underground forums. The breach underscores the persistent threat posed by cybercriminal groups specializing in credential harvesting and identity-related fraud. No official statement from Amtrak regarding the breach’s impact or mitigation efforts has been released at this time. The incident adds to a growing list of high-profile breaches in 2024, reinforcing concerns over data security in critical infrastructure and service providers.

Fallen DNA testing firm 23andMe won court approval of a bankruptcy plan that includes settlements to provide up to $62 million to resolve thousands of data breach claims. Judge Brian C. Walsh of the US Bankruptcy Court for the Eastern District of Missouri approved the plan in a Wednesday order, overruling most creditor objections and challenges from data breach victims. Many of those former customers’ objections were deemed moot or premature, and several of them didn’t appear at a court hearing on the plan. Objections from the Justice Department’s bankruptcy watchdog and a coalition of state attorneys general were resolved ...

The Maine Office of the Attorney General reported a data breach involving the National Railroad Corporation (Amtrak) on November 4, 2020. The breach, which occurred on July 24, 2020, involved an external system breach (hacking) affecting a total of 49,289 individuals, of which 214 were Maine residents. Amtrak offered 12 months of identity theft protection services through Experian to affected individuals.

The California Office of the Attorney General reported a data breach involving Amtrak on May 28, 2020. The breach occurred on April 16, 2020, and unauthorized access was gained to Amtrak Guest Rewards accounts, potentially exposing usernames and passwords, but not financial data, credit card information, or Social Security numbers. The number of individuals affected is currently unknown.