Eurail, which sells passes, says data is being "offered for sale" on the dark web after a December breach affecting 300,000 people