Amtrak

The April 2026 Amtrak breach was attributed to ShinyHunters - the same group behind the campaign documented as this tracker's biggest connective thread, which reached more than a thousand organisations through social engineering and OAuth abuse rather than any technical exploit. Rail passenger data is distinctive: a booking is a confirmed physical movement between two specific points at a specific time, with a name attached, which is a travel pattern rather than a purchase record. For Mid-Atlantic riders on the Northeast Corridor, that pattern is often a commute, meaning the dataset describes where someone lives and works.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected; as a federally-chartered corporation (Amtrak is technically the National Railroad Passenger Corporation, majority government-owned), some claims against Amtrak may be subject to different federal-entity legal procedures than a purely private company.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.