Eurail says stolen traveler data now up for sale on dark web