Where does the CSX case file come from?

Every entry is taken from the breach report CSX lodged with the Indiana Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: CSX Data Breach

This file collects the dated facts on record for the CSX incident. The state report is dated October 20, 2026. The incident itself is dated May 29, 2026.

Timeline

144 days separate the incident date from the date it was reported.

May 29, 2026Incident dateWhen the filing says the breach took place.
October 20, 2026Report filed in IndianaDate the notice was lodged with the Indiana Attorney General.

Case facts

Filing state: Indiana
Date reported: October 20, 2026
Incident date: May 29, 2026
Receiving office: Indiana Attorney General

Case notes

CSX filed a notice with Indiana authorities on October 20, 2026, concerning a data security incident that occurred on May 29, 2026. This filing indicates that some personal information entrusted to the company may have been compromised.

The public records do not specify the exact nature of the breach or the specific categories of information involved. It is noted generally that personal information was exposed, but detailed breakdowns of data types are not included in the available documentation.

As of the filing date, the investigation into the breach is categorized as 'monitoring.' This status suggests an ongoing assessment or a period of oversight following the initial incident response, emphasizing the need for affected individuals to maintain awareness of their personal data security.

To safeguard against potential misuse of the exposed information, individuals should remain proactive. This includes regularly reviewing financial statements and other account activity for any unauthorized transactions or suspicious behavior. Consider enabling multi-factor authentication on all online accounts where available to add an extra layer of security.

It is also wise to be cautious of unsolicited communications, such as emails, texts, or phone calls, that request personal details. Verify the legitimacy of any such requests directly with the organization through official channels, rather than responding to the message itself.

These details are derived from official public disclosures made to state regulators in Indiana, providing a factual record of the reported data security event.

Questions about this case file

Where does the CSX case file come from?: Every entry is taken from the breach report CSX lodged with the Indiana Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Indiana data breaches

Filing source: Indiana Attorney General

Named in the CSX breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More Indiana case files