Holidaymakers across Europe are facing the stress and expense of getting new passports after their personal data was posted on the dark web after a hack of the Interrail company Eurail.

Personal data, including passport numbers, names, phone numbers, email and home addresses and dates of birth of more than 300,000 European travellers were breached in December. But this week Eurail revealed to customers that “data copied during the security incident has been offered for sale on the dark web and a sample dataset has been published on Telegram”.

The announcement has led to renewed anger and confusion. The UK Passport Office has told at least one customer they needed to “cancel their passport to prevent it being used for fraudulent activity”, with the Home Office agency also indicating they needed to pay the full £102 fee for a replacement.

Another affected customer in Denmark said they had been obliged to cancel their passport, with replacement likely costing over £200.

“Its an absolute nightmare,” said one customer who had her details hacked, as did another member of her holiday group that travelled from Penzance to Naples last summer. She said the news that the data was for sale on the dark web “did freak me out”, and she was worried about getting a new passport in time for her summer travel plans.

“I genuinely have no idea how serious this is,” she said, requesting anonymity. “Do I really need to spend my money doing all this? No one wants to spend £100 when they don’t have to. If the official advice is to get a new passport, there does need to be some sort of compensation.”

Eurail is the Dutch company that sells Interrail passes that people use for holidays across Europe. A seven-day pass allowing rail travel in 33 countries from the northern tip of Norway to the southern shores of Turkey costs €286 for people aged up to 28, €381 for 28- to 59-year-olds and €343 for people 60 and over. Two children under 12 can travel free with an adult.

Gerard Tubb, 64, a former broadcast journalist from Yorkshire who had bought Interrail tickets to travel with his wife to the south of France last year, had his data stolen. He said: “The concern is what can people do with that amount of information. It seems an awful lot – everything to persuade someone they are me.”

Eurail told affected customers this week to “remain extra vigilant for unexpected or suspicious phone calls, emails, or text messages asking for personal information” and to update the password they use to access the Rail Planner app and change email, social media and banking passwords.

“We take the security of your data seriously and regret any concern this incident may cause,” it said.

But Tubb said: “They didn’t take the security of my data seriously and what value is the regret? Who is going to pick up the pieces if someone uses that material?”

Writing on Reddit, another affected customer said: “I am currently an exchange student in different country so I can’t even get a new passport so I am scared.” Another said: “Is there a way we can collectively get together to get compensation. At least some compensation to get a new passport would be nice.”

One user said they had written to Eurail’s chief executive in the Netherlands demanding compensation under article 82 of the General Data Protection Regulation (GDPR). Eurail and the Home Office have been approached for comment.

Eurail said it was still in the process of notifying affected customers, but said all of those whose details appeared in the sample dataset published on Telegram had been informed.

“Preventing and mitigating any potential impact on our customers remains our highest priority,” a spokesperson said. “As part of our response, we are advising customers to remain vigilant for suspicious communications, update their passwords and monitor their accounts for any unusual activity. We apologise for the unease this incident may cause and remain committed to protecting our customers’ data.”