National Railroad Passenger Corporation (amtrak.com) Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What happened

The National Railroad Passenger Corporation was listed on April 12, 2026, by the group shinyhunters. The listing states that internal files were exfiltrated during a ransomware attack. The group claims that more than 9.4 million Salesforce records containing personal information and other corporate data were taken. The post includes a deadline of April 14, 2026, for contact and describes the message as a final warning. The number of individuals affected remains undisclosed.

The group behind it: shinyhunters

Shinyhunters is a publicly documented threat actor that specializes in data extortion. The group typically gains access to cloud-hosted environments, removes large volumes of records, and then lists victim organizations on dedicated leak sites. Its pattern involves publishing sample data or descriptions of the material and setting payment deadlines before further distribution. The group has previously claimed responsibility for incidents involving customer and employee records from multiple sectors. In this case, the listing of the National Railroad Passenger Corporation constitutes the group’s claim; independent confirmation of the volume or contents has not been reported.

About National Railroad Passenger Corporation

The National Railroad Passenger Corporation operates the primary intercity passenger rail network in the United States under the Amtrak brand. The organization maintains systems that process reservations, ticketing, loyalty programs, and employee records. Entities of this type routinely store names, contact details, payment information, travel histories, and internal operational documents. A compromise affecting such records can intersect with both customer service functions and regulatory obligations tied to transportation infrastructure.

What data was at risk

The listing describes internal files removed from Salesforce environments and states that the material includes personally identifiable information along with other corporate data. The precise categories of records, the time period covered, or the number of unique individuals involved have not been confirmed by the organization. Public details therefore remain limited to the group’s description of the claimed exfiltration.

What's at stake

People whose information appears in the claimed records could encounter follow-on attempts at fraud or account misuse if the material is distributed. For the organization, the incident adds to operational and regulatory workload associated with assessing the scope of access and notifying affected parties where required. Because the exact contents and reach of the data remain unconfirmed, the practical impact on any single individual cannot yet be quantified from available information.

If your data was in this claimed breach

Monitor financial accounts and credit reports for unusual activity. Enable multi-factor authentication on any Amtrak-linked services and consider changing passwords used across other platforms. Individuals can run a free exposure scan of their email address against known breach datasets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.