Customers' Personal Information Might Have Been Exposed in an Amtrak Data Breach
Last week, The National Railroad Passenger Corporation or Amtrak, as it's better known, filed a data breach notification with the Office of the Vermont Attorney General, and it also started sending it to some of its customers. It says that in April, an unknown cybercriminal (or cybercriminals) managed to access some Amtrak accounts.
What we know
The attack was first detected on the evening of April 16, when Amtrak's IT team noticed that "a third party" had gained unauthorized access to accounts owned by travelers participating in Amtrak's Guest Rewards program. Once they were inside, the criminals were able to view the account owners' personal information. The notification points out that the potentially compromised information doesn't include any financial data or Social Security Numbers.
Within a few hours, Amtrak kicked off the intruders and began an investigation, which revealed that the attackers used compromised login credentials to break in. A password reset was forced for every single one of the affected accounts, and outside cybersecurity experts were called in to confirm that the breach has been closed. Although the nature of the potentially compromised data doesn't appear to be especially sensitive, affected customers can enroll for a one-year membership of Experian's IdentityWorks fraud protection service completely free of charge. The breach notification is accompanied by instructions on what users need to do to take advantage of the fraud protection service as well as tips on how they can protect themselves from identity theft.
On the face of it, Amtrak appears to be taking the incident seriously, and although it came more than a month after the railroad service learned about the attack, the disclosure seems to be transparent enough. When you look closer, however, you'll see that some pieces of the puzzle are still missing.
What we don't know
The exact nature of the potentially compromised information, for example, remains unknown. We do know that no credit card numbers were involved, but users still don't have a list of details that may have been accessed.
The number of affected customers is also a mystery. The investigation appears to be well and truly over, which means that Amtrak is either unaware of who was compromised exactly or is unwilling to publicly share this information. Whatever the case, not knowing how many people got hit means that it's difficult to determine the scale of the attack.
The most crucial bit of information that's missing from Amtrak's disclosure, however, is the source of the compromised login credentials. There are two options: the attackers either stole them from the railroad service itself, or they took them from a database leaked during an unrelated breach and used them to compromise accounts of people who reuse their passwords.
If the data was stolen from Amtrak, it would mean that at least up until mid-April, the company was not storing users' passwords correctly. On the other hand, if it turns out that the attackers used credential stuffing, then this would mean that Amtrak's users are the ones who are not following the best password security practices.
In the first scenario, there really isn't much you can do. Regardless of whether or not you are an Amtrak customer, however, you can (and must) make sure that you don't reuse the same password for more than one account. This is the easiest way of staying safe in the event of a credential stuffing attack.
