CSX vishing attack exposed SSNs and bank details of about 40,000 current and former employees

Teaser from the source

Rail freight company CSX is notifying about 40,000 current and former employees that their personal data was exposed. An attacker gained access to CSX's Microsoft 365 environment after an employee responded to a vishing (voice phishing) call, and accessed and took files between May 29 and June 9 2026. The exposed data includes names, Social Security numbers, driver's license numbers and banking information. CSX also disclosed a separate April 2026 incident in which a third-party vendor may have disclosed data about current and former employees. CSX began mailing notification letters on Oct 20 2026, has notified law enforcement and is offering free credit monitoring and identity protection.

This is the RSS-feed teaser. Read the full article at the original source.