CSX Corporation

bd_907a3579b9bb6bca · schema v1 · pii pii-v2

CSX notified the NH Attorney General of two separate incidents involving unauthorized access to its Microsoft 365 environment. One incident involved a third-party vendor potentially disclosing data in April 2026. The second, unrelated incident occurred after an employee responded to a vishing call on May 29, 2026, allowing an attacker to access and acquire files between May 29 and June 9, 2026. CSX became aware of the second incident in June 2026. The investigation determined that names, Social Security numbers, driver's license numbers, and banking information of current and former employees and third parties were accessed. 57 New Hampshire residents were affected. CSX secured the account, engaged forensic investigators, notified law enforcement, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source