Almeida Law Group is investigating a data breach at CSX. If you were affected, contact Almeida Law Group.
About CSX
CSX Corporation is a major freight rail transportation company headquartered in Jacksonville, Florida, and one of the largest rail operators in the eastern United States. The company provides traditional rail freight and intermodal container and trailer transport services across approximately 20,000 route miles spanning 26 states, the District of Columbia, and two Canadian provinces. CSX is publicly traded on NASDAQ and employs approximately 21,000 to 23,500 people. Because CSX operates at a large scale and employs tens of thousands of workers, it holds significant volumes of employee and business-related personal information, making a breach involving Social Security numbers and financial account data particularly serious.
What Happened?
CSX was listed in a Vermont Attorney General breach report summary published on October 20th, 2026. According to that filing, the categories of information involved include Social Security numbers, government ID numbers, financial account codes, and credit and debit account information. The filing does not disclose the date of the underlying incident, the number of people affected, or the method of attack. No attack vector, responsible threat actor, or notification timeline has been publicly confirmed by CSX or regulators based on available information.
CSX has a documented prior cybersecurity incident from early 2021, in which the Clop ransomware gang exploited a vulnerability in Accellion’s legacy file transfer software and leaked what appeared to be internal spreadsheets containing personal information about CSX employees and retirees. CSX confirmed that incident and notified law enforcement. Ukrainian police later arrested six alleged Clop members connected to attacks on multiple companies, including CSX. It is not known whether the October 2026 filing is related to that earlier event or represents an entirely separate incident.
Key Facts at a Glance
- Company or Organization: CSX Corporation
- Industry: Freight rail transportation (Railroads / Industrials)
- Location: Jacksonville, Florida
- Incident type: Data breach involving personal and financial identifiers
- Date breach discovered: October 20th, 2026
- Prior breach: Yes — 2021 Clop ransomware attack via Accellion software vulnerability; employee and retiree personal data exposed
- Litigation status: No class action lawsuit tied to this October 2026 breach has been filed as of available reporting
- Source: Vermont Attorney General breach report summary; FreightWaves (2021 prior incident); Railway Track and Structures (2021 prior incident); Benzinga (Clop arrests); CSX Company Overview
What Should You Do?
If you believe your information was involved in this breach, consider placing a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Review your credit reports for unfamiliar accounts or inquiries by visiting AnnualCreditReport.com, where you can request free reports. Monitor your bank and financial accounts closely for unauthorized transactions, and report any suspected identity theft to the Federal Trade Commission at IdentityTheft.gov, which can help you build a personalized recovery plan. Because financial account codes and credit and debit account information were among the data types reported, pay particular attention to any unexpected charges or new account activity.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
