CSX vishing attack exposed SSNs and bank details of about 40,000 current and former employees
CSX Microsoft 365 environment (employee records)
Rail freight company CSX is notifying about 40,000 current and former employees that their personal data was exposed. An attacker gained access to CSX's Microsoft 365 environment after an employee responded to a vishing (voice phishing) call, and accessed and took files between May 29 and June 9 2026. The exposed data includes names, Social Security numbers, driver's license numbers and banking information. CSX also disclosed a separate April 2026 incident in which a third-party vendor may have disclosed data about current and former employees. CSX began mailing notification letters on Oct 20 2026, has notified law enforcement and is offering free credit monitoring and identity protection.
Why this severity: About 40,000 current and former employees notified; Social Security numbers, driver's license numbers and banking information exposed
- Started
- May 29, 2026
Affected
- CSX current and former employees (about 40,000 notified)
Fixed in
No fixed release yet
Timeline4
CSX says it mailed notifications to about 40,000 current and former employees and offers complimentary credit monitoring and identity protection.
CSX begins mailing breach notification letters and files notices with state regulators, including the Vermont Attorney General.
A CSX employee responds to a vishing call, giving an attacker access to CSX's Microsoft 365 environment; files are accessed and taken until June 9.
A third-party vendor may have disclosed CSX data about current and former employees to an unauthorized party (a separate incident CSX disclosed alongside the main one).
Advisories1
News & write-ups2
Notes & caveats
Total of about 40,000 notified comes from CSX via WTOL. State filings seen: Vermont (9 residents); claim-site reports also cite Massachusetts and New Hampshire filings, not independently checked. Attacker identity not disclosed.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
