CSX data breach exposes employee data incl. SSNs (~40,000 notified)
Severity: medium · Patch status: no-fix-needed · Since 2026-11-03
CSX, one of the largest US freight railroads, disclosed a cybersecurity attack in which unauthorized parties accessed employee data, including Social Security numbers. The incident occurred between May 29 and June 9, 2026, when CSX became aware of the attack. The company has mailed notification letters to approximately 40,000 current and former employees nationwide; the number of Ohio residents affected has not been confirmed. No threat actor, ransomware claim, or technical root cause has been publicly attributed, and no vendor patch applies. Affected individuals face elevated risk of identity theft and should monitor credit and consider fraud alerts or credit freezes.
What to do
- Affected current/former employees should review the notification letter and enroll in any offered credit monitoring
- Place fraud alerts or credit freezes with major credit bureaus given SSN exposure
- Monitor financial accounts and IRS/tax records for fraudulent activity
- Organizations should review HR data access controls and detection coverage for similar intrusions
Sources
All live incidents on Threat Watch
