The RailYatri Leak Holds Nearly as Many Records as Taiwan’s Population

HEROIC analysts identified a dataset tied to RailYatri, India's government-approved online travel agency, circulating on a Telegram channel. The data is dated December 1, 2022, and contains 23,212,785 records made up of email addresses, phone numbers, first names, and last names. RailYatri has not confirmed this incident, so it should be treated as an unverified leak rather than a company statement, though the scale of the dataset makes it one of the larger leaks HEROIC has tracked.

Why 23 Million Records Is a Number Worth Taking Seriously

To put this in perspective, 23,212,785 records is roughly the population of a mid-sized country, all tied to people who simply wanted to book a train ticket. Because RailYatri is used for everyday travel bookings across India, the people in this dataset span an enormous cross-section of the public, not a narrow group of enthusiasts or niche customers, which is exactly what makes a leak of this size so attractive to attackers running large-scale scam campaigns.

What Was Exposed in the RailYatri Leak

• Email addresses
• Phone numbers
• First names
• Last names

Why This Matters Even Without Stolen Passwords

No passwords appear in this dataset, but a real name paired with a working phone number and email is still a powerful tool for fraud. Attackers use these details to run convincing phishing and smishing campaigns, sending messages that reference your actual name and appear to come from a travel provider, bank, or delivery service. The same information also supports SIM-swapping attempts, where an attacker convinces a mobile carrier to transfer your number to a device they control in order to intercept the codes that protect your other accounts.

How a Database Leak of This Size Reaches Telegram

This incident is classified as a database leak, meaning an attacker gained direct access to RailYatri's backend customer records rather than targeting individual travelers one at a time. A leak of over 23 million records typically points to a full export of a customer database, likely through a software vulnerability or exposed system, rather than a slow accumulation of stolen data. Once obtained, it was shared through a Telegram channel, a distribution method that lets stolen datasets spread quickly to a wide audience of buyers and other threat actors.

Check If Your Data Was in the RailYatri Leak

The only way to know for certain if your information appears in this leak, or in any of the thousands of others HEROIC tracks, is to check directly. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this one, and tells you instantly if you were affected. If you get a match, be cautious of unexpected calls, texts, or emails referencing your travel bookings, and consider adding extra verification with your mobile carrier.