Casey Ryback (Seagal) has retired from the Navy and is a chef at the Mile High Cafe in Denver, Colorado. Ryback is taking his estranged niece Sarah Ryback (played by a then-unknown Heigl) to Los Angeles to visit the grave of Ryback's brother, who was Sarah's father. They board a train traveling through the Rocky Mountains from Denver to Los Angeles.
As the train proceeds through the Rockies, two people wave it down. The driver and an engineer step out and are killed. A group of mercenaries led by computer genius Travis Dane (Eric Bogosian) and mercenary leader Penn (McGill) hijack the train. Dane is a satellite programming expert who worked on a top secret satellite laser weapon called "Grazer One". Dane was fired and faked his death. They herd the passengers and staff into the last two train cars and cut the train's phone lines. Two of Dane's former Department of Defense colleagues are on board the train, hiding their romantic relationship that goes against DoD regulations. Dane has them brought to him and threatens to have one of his mercenaries insert a burning needle into their eye, causing it to explode, unless they give him the codes needed to take over Grazer One. They give him the codes and Dane has them killed.
Middle Eastern terrorists have offered Dane one billion dollars to destroy the Eastern seaboard by using Grazer One to target a nuclear reactor located under the Pentagon. Dane blows up a Chinese chemical plant in order to demonstrate Grazer One's capabilities to his investors and, after one investor offers an additional 100 million dollars, Dane destroys an airliner carrying the investor's ex-wife.
The US government cannot locate Dane's headquarters and cannot target Grazer One because Dane creates fifty "ghost satellites" to hide the location of the real Grazer One. When officials destroy what they think is Grazer One, it turns out that they destroyed the NSA's best intelligence satellite. As long as the train keeps moving, his location cannot be fixed. Ryback, who has discovered the plot, takes matters into his own hands. Ryback enlists an eager porter named Bobby Zachs (Morris Chestnut) to help him. He also sends a message to the owner of the Mile High Cafe, with whom is is friendly. Ryback kills the mercenaries one by one, including one of his former men (Peter Greene).
After Penn takes Sarah as bait for Ryback, Ryback confronts Penn, who is aware of Ryback's military past. Ryback ultimately disarms and kills Penn by breaking his neck. He then finds Dane who is about to depart in a chopper hovering over the train. When Dane informs Ryback that there is no way to stop the satellite from destroying Washington, Ryback shoots him, the bullet destroying his computer and injuring and knocking Dane out a window, causing him to fall out of the train and off of a bridge. Control of the satellite is restored at the Pentagon and it is destroyed by remote control one second before it would have fired on the Pentagon.
The train collides with a freight train carrying several gasoline tank cars, resulting in a massive explosion. Ryback escapes from the train by grabbing a rope ladder hanging from the chopper above. The bloodied Dane, who is revealed to have survived, has also caught the ladder and attempts to climb onto the helicopter while screaming for his life. Ryback slides the door shut, severing Dane's fingers and causing him to fall to his death. Ryback informs the Pentagon that the passengers are safe, as he previously detached the passenger section from the rest of the train. Ryback and Sarah pay their final respects at her father's gravestone.