Credit card numbers, expiration dates, and card verification codes were stolen.

https://www.zdnet.com/article/rail-europe-had-a-three-month-long-credit-card-breach/#ftag=RSSbaffb68