# CSX vishing attack exposed SSNs and bank details of about 40,000 current and former employees · pwn.watch > Rail freight company CSX is notifying about 40,000 current and former employees that their personal data was exposed. An attacker gained access to CSX's Microsoft 365 environment after an employee responded to a vishing (voice phishing) call, and accessed and took files between May 29 and June 9 2026. The exposed data includes names, Social Security numbers, driver's license numbers and banking information. CSX also disclosed a separate April 2026 incident in which a third-party vendor may have disclosed data about current and former employees. CSX began mailing notification letters on Oct 20 2026, has notified law enforcement and is offering free credit monitoring and identity protection. Page: https://pwn.watch/i/csx-vishing-microsoft-365-employee-data-breach-2026 · generated 2026-10-29T08:16:58.615Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: CSX Microsoft 365 environment (employee records) - Started: 2026-05-29 - Affected: CSX current and former employees (about 40,000 notified) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/csx-vishing-microsoft-365-employee-data-breach-2026/feed.xml - JSON Feed: https://pwn.watch/i/csx-vishing-microsoft-365-employee-data-breach-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/csx-vishing-microsoft-365-employee-data-breach-2026.json - This file: https://pwn.watch/i/csx-vishing-microsoft-365-employee-data-breach-2026/llms.txt ## Updates (newest first) - 2026-10-28: CSX says it mailed notifications to about 40,000 current and former employees and offers complimentary credit monitoring and identity protection. (https://www.wtol.com/article/news/local/employee-information-exposed-in-csx-data-breach/512-704cf584-bcbb-4a8d-976f-20d1f373dafb) - 2026-10-20: CSX begins mailing breach notification letters and files notices with state regulators, including the Vermont Attorney General. (https://ago.vermont.gov/categories/security-breach-notices) - 2026-05-29: A CSX employee responds to a vishing call, giving an attacker access to CSX's Microsoft 365 environment; files are accessed and taken until June 9. (https://www.isssource.com/rail-company-csx-hit-in-cyberattack/) - 2026-04: A third-party vendor may have disclosed CSX data about current and former employees to an unauthorized party (a separate incident CSX disclosed alongside the main one). (https://www.isssource.com/rail-company-csx-hit-in-cyberattack/) ## Fix brief # Security brief: CSX vishing attack exposed SSNs and bank details of about 40,000 current and former employees Source: https://pwn.watch/i/csx-vishing-microsoft-365-employee-data-breach-2026 · status: live · severity: medium · updated Oct 29, 2026, 05:48 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is Rail freight company CSX is notifying about 40,000 current and former employees that their personal data was exposed. An attacker gained access to CSX's Microsoft 365 environment after an employee responded to a vishing (voice phishing) call, and accessed and took files between May 29 and June 9 2026. The exposed data includes names, Social Security numbers, driver's license numbers and banking information. CSX also disclosed a separate April 2026 incident in which a third-party vendor may have disclosed data about current and former employees. CSX began mailing notification letters on Oct 20 2026, has notified law enforcement and is offering free credit monitoring and identity protection. Severity detail: About 40,000 current and former employees notified; Social Security numbers, driver's license numbers and banking information exposed - Product: CSX Microsoft 365 environment (employee records) ## Affected versions - CSX current and former employees (about 40,000 notified) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Specific notes Nothing to patch. If you are a current or former CSX employee, watch for the notification letter, enroll in the offered credit monitoring, consider a credit freeze, and treat calls or emails claiming to be from CSX IT or HR with suspicion. ## Latest updates - Oct 28, 2026: CSX says it mailed notifications to about 40,000 current and former employees and offers complimentary credit monitoring and identity protection. - Oct 20, 2026: CSX begins mailing breach notification letters and files notices with state regulators, including the Vermont Attorney General. - May 29, 2026: A CSX employee responds to a vishing call, giving an attacker access to CSX's Microsoft 365 environment; files are accessed and taken until June 9. - Apr 2026: A third-party vendor may have disclosed CSX data about current and former employees to an unauthorized party (a separate incident CSX disclosed alongside the main one). ## Advisories - [Security Breach Notices (CSX, Oct 20 2026)](https://ago.vermont.gov/categories/security-breach-notices) (Vermont Attorney General) ## Write-ups & news - [CSX data breach exposes employee information](https://www.wtol.com/article/news/local/employee-information-exposed-in-csx-data-breach/512-704cf584-bcbb-4a8d-976f-20d1f373dafb) - [Rail Company, CSX, Hit in Cyberattack](https://www.isssource.com/rail-company-csx-hit-in-cyberattack/) ## Caveats Total of about 40,000 notified comes from CSX via WTOL. State filings seen: Vermont (9 residents); claim-site reports also cite Massachusetts and New Hampshire filings, not independently checked. Attacker identity not disclosed. --- Machine-readable: https://pwn.watch/i/csx-vishing-microsoft-365-employee-data-breach-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.