Hackers Derail Amtrak Guest Rewards Accounts in Breach

The US passenger rail giant said attackers used previously compromised credentials to crack accounts and access a freight train of personal data.

Amtrak has disclosed a data breach affecting train travelers Guest Rewards accounts.
In a breach-disclosure notice filed with the state of Massachusetts, the national passenger rail service noted that an unknown third party gained unauthorized access to users account information during the time period of May 15-18.
The transport giant determined that compromised usernames and passwords from prior breaches were likely used to access certain accounts, and stressed in
the breach notice
that there was no hack of Amtrak systems.
Even so, the information that the threat actor accessed includes a social engineering bonanza of data, including name, contact information, Amtrak Guest Rewards account number, date of birth, payment details (such as partial credit card number and expiration date), gift card information (such as card number and PIN) and/or information about your transactions and trips.
In some cases, the
hackers took over accounts
and changed emails and passwords to lock legitimate users out. Amtrak was able to nip that in the bud, though: We have changed the email address for your Amtrak Guest Rewards account back to your email address and initiated a reset of your account password.
Amtrak didnt elaborate on how many rail aficionados are affected, but urged riders to rotate their passwords and
implement multifactor authentication
to prevent account access and takeovers.
Threat actors have realized the high rewards of stealing from travel loyalty programs, which can easily be sold on the Dark Web or converted to tickets that they later sell, said Stuart Wells, Jumio CTO, in an emailed statement shared with media. Its a reality thats particularly tough on travelers who have worked for months, or even years, to accumulate loyalty points and status through regular trips. Customers who are less frequent travelers may not notice their points disappearing for a long time.
This isnt the first time the data breach engine has left the Amtrak station. In 2020, it disclosed a
Guest Rewards breach
in which some personal information may have been viewed, according to
the notification
, where the threat actor was noticed and booted out of the system within a few hours.
Jumios Wells noted that, given the weaknesses known to be present in
most mainstream MFA techniques
, businesses could go further to protect consumer accounts.
As cyber threats evolve, businesses must adopt advanced verification technologies to enhance the protection of sensitive user data. Implementing a robust identity verification system is crucial to effectively combat fraud in all forms, he said.
For instance, utilizing
biometric verification
methods ensures that illegitimate users and hackers are hindered before causing further harm, as they would need more than just credentials to gain access. This approach protects consumers from having their personal details disclosed from compromised accounts and provides a very effective solution to combat fraud.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Hackers Derail Amtrak Guest Rewards Accounts in Breach