HackingTransportation & LogisticsTransportationVulnerability ExploitData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

CSX Corporation

bd_3eb59b777a08064c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 9, 2021

Filed

Mar 16, 2021

To disclose

5 weeks

Affected

13state residents only

Confidence

66%

Full breach record for CSX Corporation →2 incidents on file

CSX Transportation, Inc. notified Montana residents of a data breach involving unauthorized access to its Accellion File Transfer Appliance (FTA) via a vulnerability exploited on December 25, 2020. CSX discovered the potential unauthorized access on February 9, 2021. The incident may have exposed names and Social Security numbers. CSX engaged law enforcement, conducted an investigation, and offered one year of credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 46 days

discovery → filing · 5 weeks / 35 days

Dec 25, 2020

Begins

Feb 9, 2021

Discovered

Mar 16, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed13 affectedView incident

Name: CSX Corporation
norm: csx
Domain: csx.com

Name: CSX Corporation
norm: csx
Domain: csx.com
Industry: Transportation & Logisticsllm

Discovered: Feb 9, 2021
Breach occurred: Dec 25, 2020
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 21, 2021
Affected individuals: 13state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Contacted law enforcement
Initial access: exploit_public_facing

During the incident: Contacted law enforcement
Launched an investigation
Secured the services of TransUnion to offer complimentary one-year membership of TransUnion’s myTrueIdentity
Taken the Accellion FTA offline permanently
Changes made: Taken the Accellion FTA offline permanently
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/csx-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 16, 2021
Raw hash: d6e3bd37431ad1725ffac3bf6760145d11008d21714a8c6fab94bb415f7496fd

Reporting entityCSX Corporation

Victim entityCSX Corporation

Incidentdiscovered Feb 9, 2021

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov