CSX data breach investigation (2026 Microsoft 365 vishing incident)

CSX, the Jacksonville, Florida, freight railroad, began mailing data breach letters on October 20, 2026. The letters say an outsider took files from the company's Microsoft 365 system after an employee responded to a "vishing" phone call, and that some recipients' Social Security numbers, driver's license numbers or bank account details were in those files. Several law firms are now investigating possible class claims.

This page covers that investigation. There is no settlement or claim form. CSX's notice to the New Hampshire Attorney General, filed by its lawyers at BakerHostetler, is the main source for the facts below. CSX has not said publicly how many people were affected in total.

CSX Corporation is based in Jacksonville. Its 2025 annual report says its main subsidiary, CSX Transportation, runs a rail network of about 20,000 route miles serving 26 states east of the Mississippi River, the District of Columbia and the Canadian provinces of Ontario and Quebec, and that the company had about 23,000 employees as of December 2025.

The people who received letters are the potential claimants. The sample letters filed with New Hampshire do not say whether recipients are employees, customers or others. CSX's cover letter says the separate vendor incident may have involved information about current and former employees and third parties.

Law firms that have posted investigation pages include Levi & Korsinsky and Dapeer Law. Those pages are lawyer advertising.

CSX describes two separate incidents in its New Hampshire filing.

• Vendor incident: CSX learned that a third-party vendor may have disclosed CSX data to an unauthorized party. Its investigation "could not rule out" that information about current and former employees and third parties was shared in April 2026. The vendor is not named.
• Vishing incident: In June 2026, CSX was alerted to unusual activity in an employee's account. It says it secured the account, began an investigation and notified law enforcement. The investigation found the employee had responded to a vishing call on May 29, 2026, which gave an unauthorized party access to CSX's Microsoft 365 environment. Between May 29 and June 9, 2026, that party "accessed and acquired certain files."

On August 26, 2026, CSX determined that one or more files contained names together with Social Security numbers, driver's license numbers or banking information. On September 28, 2026, it confirmed that New Hampshire residents were involved. Letters went out by first-class mail on October 20, 2026, including to 57 New Hampshire residents.

The filing includes two sample letters. One covers only the vishing incident and lists name and Social Security number. The other covers both incidents and lists name, driver's license number, bank account number and routing number. Your own letter controls what applies to you.

CSX says it is enhancing its security protocols and adding security measures. It is offering identity monitoring through Epiq Privacy Solutions ID at no cost, including three-bureau credit monitoring, fraud consultation and identity theft restoration. The length of coverage appears only as a blank field in the sample letters.

The law firms say they are evaluating whether CSX protected the data adequately and whether affected people can seek compensation. Those are questions under investigation, not findings. CSX has not been found to have done anything wrong.

No court has ruled on anything about this incident. A federal case titled Kittrell v. CSX Corporation, No. 3:26-cv-02916, was opened in the Middle District of Florida on October 23, 2026, with a jury demand. The complaint was not publicly available when this article was written, so Class Action Pulse has not confirmed what it alleges or whether it concerns these incidents. This page will be updated if a filed complaint is confirmed.

You are most likely to be affected if you received a CSX letter dated on or after October 20, 2026, describing the Microsoft 365 incident, the vendor incident or both. The firms' investigations generally focus on letter recipients. If no class action is filed and certified, there is no formal class.

Not everyone with a CSX connection was affected. CSX says it notified only people whose information it found in the files.

• Keep the letter and envelope. They show the date, the incidents and the data involved.
• Enroll in the free Epiq monitoring using the activation code in your letter before the enrollment deadline it lists. The site is privacysolutionsid.com, and Epiq's help line is 866-675-2006.
• If your Social Security number was involved, consider a free credit freeze with Equifax, Experian and TransUnion.
• If your bank account and routing numbers were involved, ask your bank about account alerts or a new account number.
• Watch for calls, texts and emails that claim to come from CSX, your bank or a lawyer. The breach itself began with a phone scam.
• Call CSX's incident line at 888-619-1563, weekdays 9 a.m. to 9 p.m. Eastern, with questions.
• Keep records of any fraud, time spent or costs. They could matter if a case or settlement follows.

Nothing is available now beyond the free monitoring CSX is offering. In data breach cases that end in settlement, benefits often include reimbursement of documented losses, small cash payments and more monitoring. Whether that happens here is unknown.

• April 2026: vendor-related disclosure may have occurred.
• May 29 to June 9, 2026: files accessed and acquired after the vishing call.
• August 26, 2026: CSX identified personal information in the files.
• October 20, 2026: letters mailed.
• October 23, 2026: Kittrell v. CSX Corporation opened in federal court.

Time limits for data breach claims vary by state and legal theory. There is no claim deadline because there is no settlement.

• Vishing: voice phishing, a phone call that tricks someone into giving access or information.
• Microsoft 365 environment: a company's email, file storage and office apps hosted by Microsoft.
• Credit freeze: a free block that stops new credit from being opened in your name.
• Investigation: a law firm's review of whether to file a lawsuit. It is not a lawsuit.

More state attorney general filings may reveal the total number of people notified. If lawsuits are filed in more than one court, they may be combined. Any settlement would need court approval and would come with official notice and a claim process.

The incident facts come from CSX's New Hampshire filing, including both sample letters, and company facts come from its annual report. The total number affected, the vendor's name and the monitoring length are not public. The Kittrell docket entry was confirmed, but its complaint was not reviewed.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.