Rail firm LNER has confirmed that customer details were accessed in a data breach – and that impacted passengers will be contacted directly.

Following the breach in September, LNER has begun sending out emails to affected customers directly after key details were exposed.

LNER has stressed that no bank, payment card or password information was impacted and the emails are only being sent out to people who have been affected by the leak.

It has now been revealed that customers' names and email addresses have been exposed in the breach. While no passwords were compromised, LNER also warned customers to maintain secure passwords and to change them regularly.

LNER has confirmed passenger details were accessed in a data breach.

placeholder image — LNER has confirmed passenger details were accessed in a data breach.

In the email sent out to affected customers, LNER stated: "On 8 September 2025 we were told that one of our suppliers, who manages our customer communication database, had suffered a security incident. A third-party gained unauthorised access to the supplier’s networks and in the process gained access to customer data.

"As a result of our investigation of the breach so far, we have concluded that the data included some personal information, specifically your name and email address.

"No payment card details, passwords or your LNER account information were involved. Our ticketing systems remain safe, and you can continue to buy tickets from LNER as normal.

"Because your name and email address were affected, it’s possible you will receive phishing or scam messages.

"We are continuing to work closely with our supplier, who has engaged independent security experts, to put enhanced security controls in place to minimise the risk of this happening again."

The company warns those affected to do the following:

Remain vigilant against phishing or scam attempts, including unexpected communications asking for personal or financial information.

Don’t click on links or download attachments in suspicious emails.

Be aware that phishing attempts may appear to come from LNER when they have not. Emails sent from LNER will end in @lner.co.uk or @email.lner.co.uk; threat actors may try to imitate this with similar characters, for example, using the number 1 instead of the letter L. You can contact us at [email protected] if you are in doubt about whether an email or message comes from LNER.