Threatline

Amtrak - 2,147,679 breached accounts

In April 2026, the hacking group . The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly. They subsequently published the alleged data which contained over 2M unique email addresses along with names, physical addresses and customer support records. ShinyHunters claimed they had breached Amtrak