CSX Corporation

CSX reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-10-20. The reporting organization type is Other Commercial. 9 Vermont residents were affected. Categories of data breached: Social Security Numbers, Government ID Numbers, Financial Account Codes, Credit and Debit Account Info.

CSX notified the NH Attorney General of two separate incidents involving unauthorized access to its Microsoft 365 environment. One incident involved a third-party vendor potentially disclosing data in April 2026. The second, unrelated incident occurred after an employee responded to a vishing call on May 29, 2026, allowing an attacker to access and acquire files between May 29 and June 9, 2026. CSX became aware of the second incident in June 2026. The investigation determined that names, Social Security numbers, driver's license numbers, and banking information of current and former employees and third parties were accessed. 57 New Hampshire residents were affected. CSX secured the account, engaged forensic investigators, notified law enforcement, and is offering credit monitoring.

CSX notified individuals of two separate data security incidents involving name, Social Security number, bank account number, routing number, and driver's license number. The company is offering 24 months of identity monitoring through Epiq and states it is enhancing security protocols. No specific dates, counts, or attack vectors were disclosed in the notice.

CSX Transportation, Inc. notified Montana residents of a data breach involving unauthorized access to its Accellion File Transfer Appliance (FTA) via a vulnerability exploited on December 25, 2020. CSX discovered the potential unauthorized access on February 9, 2021. The incident may have exposed names and Social Security numbers. CSX engaged law enforcement, conducted an investigation, and offered one year of credit monitoring via TransUnion.

CSX reported a data breach to the Delaware Attorney General. The breach occurred on 2013-09-06. Notice was filed on 2013-10-03. Information involved: identity government.

CSX Transportation reported an insider incident where an employee on September 6, 2013, emailed spreadsheets containing PII (names, SSNs, work status) to personal and spouse accounts. Discovered Sept 16, CSX notified law enforcement, secured deletion certifications, and offered 1 year of credit monitoring to ~4 NH residents. Notifications began Sept 30.