This week Eurostar, the international high-speed rail operator, is sending emails to its users asking them to reset their passwords in an effort to “enhance” security.
Unfortunately, users who try to reset their password or log in are encountering a “technical issues” error message, which prevents them from accessing their accounts.
Eurostar is internationally recognized for its fast and comfortable connection between the United Kingdom, France, Belgium and the Netherlands via a multitude of trains passing through the iconic Channel Tunnel.
See also: AmerisourceBergen: Pharmaceutical giant falls victim to hacking
Eurostar password reset bug locks passengers out
Eurostar is sending out emails to all its valued customers this week urging them to reset their passwords for greater security. The initiative was taken with the aim of upgrading the security of everyone's accounts.
We received a notification like the one shown below:
If you wish to continue using your Eurostar account, it is essential that you reset your password as soon as possible. Additionally, if you are an active user of the Eurostar mobile app, please ensure that it is updated to the latest version for optimal performance.
When users click on the “reset password” link, instead of a solution, an error message appears.
“We're sorry, we're experiencing some technical issues, so we can't send the email right now. Please try again later.”
Yesterday, BleepingComputer discovered the issue after trying the link provided in the email notification. Unfortunately, this issue is still occurring today.
The bug has angered Eurostar passengers and users around the world, as they can no longer access their accounts.
After each successful login attempt, users are shown the password reset interstitial ad that prevents them from accessing their account until a password reset occurs. However, the password reset never occurs due to the aforementioned technical error.
See also: Cloudflare mitigates a DDoS attack with 71 million requests-per-second
"@Eurostar how to tell your customers you hate them without saying it: lock everyone's account and make it impossible to reset their password," one user wrote on Twitter.
Others who were equally annoyed joined the discussion:
To our surprise, we noticed that some customers were confused or even panicked when they received the legitimate Eurostar email, mistakenly believing it was a phishing.
See also: Romance scams: Americans lost $1.3 billion in 2022
On Friday, Eurostar posted a lengthy thread on Twitter acknowledging the difficulties users were experiencing when trying to log into their Club Eurostar accounts. The company attributed the difficulty to ongoing maintenance activities and acknowledged that it had sent password reset emails before informing users of the ongoing technical issues.
Customers have reported that reservations and personal data are missing from their accounts.
Despite the railway operator's suggestion that customers delete their browser cookies or try re-registering with the same email address, these do not appear to correct the situation.
We have not yet determined whether Eurostar's forced password reset was due to its desire for increased security or whether it was the result of an unforeseen cyber attack, such as unauthorized access to systems or a data breach.
Information source: bleepingcomputer.com
