MisuseTransportation & LogisticsTransportationData MishandlingEmployee Data InvolvedPIIIdentity (basic)Government IDMediumResolved

CSX Corporation

bd_d2b65d18b1d26e92 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 16, 2013

Filed

Oct 3, 2013

To disclose

17 days

Affected

4state residents only

Linked

2 filings

Confidence

66%

Full breach record for CSX Corporation →2 incidents on file

CSX Transportation reported an insider incident where an employee on September 6, 2013, emailed spreadsheets containing PII (names, SSNs, work status) to personal and spouse accounts. Discovered Sept 16, CSX notified law enforcement, secured deletion certifications, and offered 1 year of credit monitoring to ~4 NH residents. Notifications began Sept 30.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 10 days

discovery → filing · 17 days

Sep 6, 2013

Begins

Sep 16, 2013

Discovered

Oct 3, 2013

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Delaware State AGbd_899360369b9416a32013-10-03Verified

Name: CSX Corporation
norm: csx
Domain: csx.com

Name: CSX Corporation
norm: csx
Domain: csx.com
Industry: Transportation & Logisticsllm

Discovered: Sep 16, 2013
Breach occurred: Sep 6, 2013
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 30, 2013
Affected individuals: 4state-resident count only
Data types: PIIIdentity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: notified law enforcement, who assisted with the investigation
Initial access: insider_action

During the incident: Immediately demanded the deletion of the emails
Notified law enforcement
Received a certification from the employee that the information was deleted
Worked with the spouse’s employer and has received a certification that the employer deleted all such emails and attachments
Retained AllClear ID to provide credit protection services
Notifying the three major credit reporting agencies
Changes made: Taking steps to further strengthen our already stringent security measures to safeguard the privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Delaware State AGOct 3 · first

New Hampshire State AGOct 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/csx-transportation-20131003.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2013
Raw hash: b5d31436bb73ac4e14f4da74433be2fe298c392b2094172fb596c34e7d265219

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCSX Corporation

Victim entityCSX Corporation

Incidentdiscovered Sep 16, 2013

Stated responseImmediately demanded the deletion of the emails

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov