Notice of Data Breach

Notice of Data Breach

What Happened

As a result of a query from one of our banks, Rail Europe North America Inc. (“Rail Europe”) discovered that unauthorized persons gained unauthorized access to our ecommerce websites’ IT platform. Upon discovery that this malicious intrusion may have compromised users’ personal information, we immediately cut off from the Internet all compromised servers and engaged information security experts to assist with forensic analysis, system restoration and security hardening.

What Information May Have Been Involved

The personal information that may have been involved is : name, gender, delivery address, invoicing address, telephone number, email address, credit/debit card number, expiration date and CVV of customers, and, in some cases, username and password of registered users who created personal accounts on a Rail Europe website.

Whose Information Was Compromised ?

Customers who made a purchase on www.RailEurope.com between November 29, 2017, and February 16, 2018, may have been impacted by this breach.

Customers who made a purchase from Rail Europe via a travel agency may have been impacted if the agent created, refunded or accessed their booking between February 5, 2018, and February 16, 2018. If you purchased a Rail Europe product from a travel agency before February 16, 2018, please contact ID Experts at (888) 230-2184 to determine whether your information may have been impacted.

What We Are Doing

Rail Europe replaced and rebuilt all compromised systems from known safe code, any potentially untrusted components were removed, passwords were changed on all systems and applications, certificates were renewed, and security controls were hardened.

We also provided notice to the credit card brands and our credit/debit card transaction processors.

As a precautionary measure we are offering impacted customers identity theft protection services through ID Experts®. The service, MyIDCare, includes : 12 months of Credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, exclusive educational materials and fully managed id theft recovery services. With this protection, MyIDCare will help you resolve issues if your identity is compromised.

What You Can Do

If you believe your information may have been compromised, we encourage you to contact ID Experts to enroll in free MyIDCare services by calling (888) 230-2184. MyIDCare experts are available Monday through Friday from 8 am - 8 pm Eastern Time.

Please note the deadline to enroll is August 31, 2018.

At this time, there is no evidence that your information has been misused. However, we encourage you to take full advantage of this service offering. MyIDCare representatives can answer questions or concerns you may have regarding protection of your personal information.

For More Information

Updated information will be provided here, at <host|>

Recommended Steps to Help Protect Your Information

Impacted Customers Can Enroll in complimentary MyIDCare identity theft protection services :

1. Enrollment. Call IDExperts at (888) 230-2184 to determine if your information was impacted. If your information was impacted you will be able to enroll in MyIDCare services. Once you have completed your enrollment, you will receive a welcome letter by email (or by mail if you do not provide an email address when you sign up). The welcome letter will direct you to the exclusive MyIDCare Member Website where you will find other valuable educational information.

2. Activate the credit monitoring provided as part of your MyIDCare membership, which is paid for by Rail Europe. Credit and CyberScan monitoring is/are included in the membership, but you must personally activate it for it to be effective. Note : You must have established credit and access to a computer and the internet to use this service. If you need assistance, MyIDCare will be able to assist you.

3. Review your credit reports. We recommend that you remain vigilant by reviewing account statements and monitoring credit reports. Under federal law, you also are entitled every 12 months to one free copy of your credit report from each of the three major credit reporting companies. To obtain a free annual credit report, go to www.annualcreditreport.com or call 1-877-322-8228 or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. (You can print a copy of the request form at www.consumer.ftc.gov/articles/pdf-0093-annual-report-request-form.pdf.) You may wish to stagger your requests so that you receive a free report by one of the three credit bureaus every four months.
When you receive your credit reports, please carefully review them for accounts that you did not open and inquiries from creditors that you did not initiate. Please also look for any personal information, such as home address or Social Security Number, that is inaccurate. If you discover any suspicious items and have enrolled in MyIDCare, notify them immediately by calling or by visiting their Member website and filing a theft report. Otherwise, call the credit-reporting agency at the telephone number on the report.
If you file a theft report with MyIDCare, you will be contacted by a member of our ID Care team who will help you determine the cause of the suspicious items. In the unlikely event that you fall victim to identity theft as a consequence of this incident, you will be assigned an ID Care Specialist who will work on your behalf to identify, stop and reverse the damage quickly.

You should also know that you have the right to file a police report if you ever experience identity fraud. Please note that in order to file a crime report or incident report with law enforcement for identity theft, you will likely need to provide some kind of proof that you have been a victim. A police report is often required to dispute fraudulent items so we recommend that you request a copy of the police report because you may need to provide it to creditors to help correct your credit report. You can report suspected incidents of identity theft to other local law enforcement or to the Attorney General.

4. Place Fraud Alerts with the three credit bureaus. If you choose to place a fraud alert, we recommend you do this after activating your credit monitoring. You can place a fraud alert at one of the three major credit bureaus by phone and also via Experian’s or Equifax’s website. A fraud alert tells creditors to follow certain procedures, including contacting you, before they open any new accounts or change your existing accounts. For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit. The contact information for all three bureaus is as follows :

Credit Bureaus
Equifax Fraud Reporting
1-866-349-5191
P.O. Box 105069
Atlanta, GA 30348-5069
www.alerts.equifax.com

Experian Fraud Reporting
1-888-397-3742
P.O. Box 9554
Allen, TX 75013
www.experian.com

TransUnion Fraud Reporting
1-800-680-7289
P.O. Box 2000
Chester, PA 19022-2000
www.transunion.com

It is necessary to contact only ONE of these bureaus and use only ONE of these methods. As soon as one of the three bureaus confirms your fraud alert, the others are notified to place alerts on their records as well. You will receive confirmation letters in the mail and will then be able to order all three credit reports, free of charge, for your review.

5. Security Freeze. By placing a security freeze, someone who fraudulently acquires your personal identifying information will not be able to use that information to open new accounts or borrow money in your name. You will need to contact the three national credit reporting bureaus listed above in writing to place the freeze. Keep in mind that when you place the freeze, you will not be able to borrow money, obtain instant credit, or get a new credit card until you temporarily lift or permanently remove the freeze. The cost of placing the freeze varies by the state you live in and for each credit reporting bureau. The Credit Bureau may charge a fee of up to $5.00 to place a freeze, lift, or remove a freeze. However, if you are a victim of identity theft and have filed a report with your local law enforcement agency or submitted an ID Theft Complaint Form with the Federal Trade Commission, there may be no charge to place the freeze.

6. You can obtain additional information about the steps you can take to avoid identity theft from the following agencies. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them.

ALL US RESIDENTS : Contact the Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW Washington, DC 20580, www.consumer.gov/idtheft, 1-877-IDTHEFT (438-4338), TTY : 1-866-653-4261.

California Residents : Visit the California Office of Privacy Protection (www.privacy.ca.gov ) for additional information on protection against identity theft.

Colorado Residents : Contact the Colorado Bureau of Investigation at 1-855-443-3489 or https://www.colorado.gov/pacific/cbi/identity-theft-fraud-and-cyber-crimes-victim-support
Connecticut Residents : Contact the Connecticut Department of Consumer Protection at 1-800-842-2649 or http://www.ct.gov/dcp/cwp/view.asp?a=1629&Q=289488&PM=1
Florida Residents : Contact the Florida Attorney General’s office at 1-866-966-7226 or http://www.myfloridalegal.com/identitytheft
Illinois Residents : Contact the Illinois Attorney General’s office at 1-866-999-5630 or http://www.illinoisattorneygeneral.gov/consumers/idtheft.html
Kentucky Residents : Contact the Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118 Frankfort, Kentucky 40601, www.ag.ky.gov, Telephone : 1-502-696-5300.

Maryland Residents : Contact the Office of the Attorney General of Maryland, Consumer Protection Division 200 St. Paul Place Baltimore, MD 21202, www.oag.state.md.us/Consumer, Telephone : 1-888-743-0023.

Nevada Residents : Contact the Nevada Attorney General’s office at 1-702-486-3132 or http://ag.nv.gov/Hot_Topics/Victims/IDTheft/
New Hampshire Residents : Contact the New Hampshire Department of Justice at 1-603-271-3658 or http://www.doj.nh.gov/consumer/identity-theft/index.htm
New Jersey Residents : Contact the New Jersey Attorney General’s office at 1- 609-292-8740 or http://www.nj.gov/oag/dcj/idtheft/
New York Residents : Contact the New York Department of State, Division of Consumer Protection at 1-800-697-1220 or https://www.dos.ny.gov/consumerprotection/identity_theft/
North Carolina Residents : Contact the Office of the Attorney General of North Carolina, 9001 Mail Service Center
Raleigh, NC 27699-9001, www.ncdoj.com/, Telephone : 1-919-716-6400.

Oregon Residents : Contact the Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, www.doj.state.or.us, Telephone : 877-877-9392

Pennsylvania Residents : Contact the Pennsylvania Attorney General’s office at 1-800-441-2555 or https://www.attorneygeneral.gov/Consumers/Identity_Theft/
Rhode Island Residents : Contact the Office of the Attorney General, 150 South Main Street, Providence, Rhode Island 02903, www.riag.ri.gov, Telephone : 401-274-4400

Texas Residents : Contact the Texas Attorney General’s office at 1-800-252-8011 or https://texasattorneygeneral.gov/identitytheft
Virginia Residents : Contact the Virginia Attorney General’s office at 1-804-786-4718 or http://www.oag.state.va.us/citizen-resources/identity-theft
Wisconsin Residents : Contact the Wisconsin Department of Agriculture, Trade and Consumer Protection, Bureau of Consumer Protection at 1-608-224-5163 or https://datcp.wi.gov/Pages/Programs_Services/IdentityTheft.aspx