CSX

Summary

CSX experienced a data breach in its Microsoft 365 environment after an employee responded to a vishing call that granted an unauthorized party access to company systems. Files were accessed and removed over a period of several days, exposing names, Social Security numbers, driver's license numbers, and banking information. A separate incident involving a third-party vendor may have also exposed information about current and former employees. Affected individuals were notified by mail, and a notice was filed with the New Hampshire Attorney General's Office.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

CSX disclosed a data breach involving its Microsoft 365 environment through a notice filed with the New Hampshire Attorney General's Office. The incident began on May 29, 2026, when an employee responded to a vishing call, which allowed an unauthorized party to gain access to CSX systems. Following the initial intrusion, the unauthorized party accessed and removed files from the environment over a period that extended from May 29, 2026, to June 9, 2026. The data taken during this window included names, Social Security numbers, driver's license numbers, and banking information. The access was facilitated through a phone scam rather than a direct technical exploit of the Microsoft 365 platform. In addition to the Microsoft 365 compromise, a separate incident involving a third-party vendor may have exposed information about current and former employees during April 2026. The employee's response to the fraudulent call served as the entry point that enabled the subsequent file access and data removal. The compromised information pertained to workforce records held within the affected systems.

CSX began notifying affected individuals by mail starting on October 20, 2026, informing them that their personal information had been taken from company systems. The notification letters advised recipients that employee Social Security numbers, driver's license numbers, and banking information were among the data elements removed by the unauthorized party. The breach affected employees whose information was stored within the compromised Microsoft 365 environment. The timeline of file access and removal spanned nearly two weeks, during which the unauthorized party remained active in the system after the initial vishing call. The separate vendor-related exposure in April 2026 represented an additional incident that may have affected current and former employees outside the May and June timeframe. The disclosure to state authorities and the mailing of notification letters constituted the company's response to the discovery of the unauthorized access. Affected individuals were alerted through mail as part of the breach notification process described in the filing.

Sources

Sources available to members: 1 source.