Amtrak (National Railroad Passenger Corporation) is the U.S. intercity passenger rail operator, a federally chartered corporation whose Board of Directors is nominated by the President and confirmed by the Senate under 49 U.S.C. Sec 24302. Its Privacy Policy (last updated July 23, 2023) discloses collection of broad personal-data categories including protected classifications such as age, sex, gender, medical condition, disability, citizenship, and military/veteran status, and states Amtrak uses third-party ad services for interest-based advertising. Under its CCPA statement, Amtrak self-declares that it may have "sold" identifiers, online-activity, and inference data to online advertising services and social networks, and separately sold email addresses to state government entities. The Amtrak iOS App Store privacy label confirms data (Browsing History, Identifiers, Other Data) is used to track users across apps and websites owned by other companies, and lists National Railroad Passenger Corporation as the app seller. A 2020 data-breach notice filed with a state Department of Justice describes unauthorized third-party access to certain Amtrak Guest Rewards accounts via compromised usernames/passwords, with no financial, credit-card, or Social Security data involved and free credit monitoring offered; no independent security audit or privacy-specific regulator finding was found in primary sources within scope.
TRACK RECORD
1 BREACH · 1 ENFORCEMENT ACTION
BREACH LEDGER
[2026-04-03] · BREACH
Have I Been Pwned lists a breach record for Amtrak: "Amtrak".
Approximately 2,147,679 accounts affected, per HIBP.
Exposed: Email addresses, Names, Physical addresses, Support tickets.
A data-breach notice sent on Amtrak's behalf, hosted by the Montana Department of Justice, states an unknown third party may have gained unauthorized access to certain Amtrak Guest Rewards accounts on July 24, 2020, that compromised usernames and passwords were used to access accounts, and that no financial data, credit card information, or Social Security numbers were compromised; Amtrak offered a year of complimentary Experian IdentityWorks credit monitoring to affected users.
Amtrak's Privacy Policy lists the categories of personal information it collects, including a "Protected Classifications" category covering age, sex, gender, medical condition, disability, citizenship status, and military/veteran status, alongside standard identifiers and commercial information.
Amtrak's own Board of Directors page states that, under 49 U.S.C. Sec 24302, board members are nominated by the U.S. President and confirmed by the Senate for five-year terms — establishing Amtrak as a federally chartered, government-controlled corporation with a statutorily defined governance structure.
The Apple App Store listing for the Amtrak app independently identifies the app's legal seller as National Railroad Passenger Corporation, Amtrak's formal corporate name.
Amtrak's CCPA-focused California Consumer Privacy Statement self-declares that it may have sold Identifiers, Online Activity, and Inferences data to online advertising services and social networks in the prior 12 months, which it states may be considered a "sale" under California law, and separately discloses selling email addresses to state government entities.
A data-breach notice sent on Amtrak's behalf, hosted by the Montana Department of Justice, states an unknown third party may have gained unauthorized access to certain Amtrak Guest Rewards accounts on July 24, 2020, that compromised usernames and passwords were used to access accounts, and that no financial data, credit card information, or Social Security numbers were compromised; Amtrak offered a year of complimentary Experian IdentityWorks credit monitoring to affected users.
Have I Been Pwned's breach catalog lists the "Amtrak" incident (amtrak.com), breach date 2026-04-03, affecting approximately 2,147,679 accounts. Data classes exposed per HIBP: Email addresses, Names, Physical addresses, Support tickets. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
Amtrak's Apple App Store privacy label discloses that Browsing History, Identifiers, and Other Data may be used to track the user across apps and websites owned by other companies.
Amtrak's Privacy Policy states it uses third-party ad services to deliver interest-based advertising tailored to users' interests, directing opt-outs to the standard DAA/NAI industry choice pages rather than a broader universal opt-out.