CSX

TransportUnited States of America

CSX is a transport organisation in New Hampshire. It appears on the Vermont Attorney General breach-notification register, the New Hampshire Attorney General breach-notification register and the Delaware Attorney General data security breach database with 3 confirmed incidents; the most recent notice was filed on October 20, 2026.

Headquarters: CSX Transportation Building, United States
ISIN: US1264081035
LEI: 549300JVQR4N1MMP3Q88
Wikidata: Q1024454

Data as of October 22, 2026.

Sources

Confirmed incident

Filed in NH and VT

The same incident was filed separately with 2 jurisdictions within a few days of each other (NH and VT) — shown here as one incident.

Disclosed: October 20, 2026

Timeline

October 20, 2026
Reported to regulator Regulator
NH AG breach notification: an unknown number of New Hampshire residents affected
^source
October 20, 2026
Reported to regulator Regulator
VT AG breach notification: 9 Vermont residents affected
^source

What a New Hampshire notice means

Governed by RSA 359-C:20. Notification to the Attorney General is required.

Note: the count is New Hampshire residents.

New Hampshire breach-notification register ↗

What a Vermont notice means

Governed by 9 V.S.A. §2435. Notification to the Attorney General is required.

Note: the count is Vermont residents.

Vermont breach-notification register ↗

Confirmed incident

US-DE

Occurred: September 6, 2013
Disclosed: October 3, 2013

Timeline

October 3, 2013
Reported to regulator Regulator
DE AG breach notification: an unknown number of Delaware residents affected
^source
October 3, 2013
Reported to regulator Regulator
DE AG breach notification: an unknown number of Delaware residents affected
^source
October 3, 2013
Reported to regulator Regulator
DE AG breach notification: an unknown number of Delaware residents affected
^source

What a Delaware notice means

Governed by 6 Del. C. §12B-102. Notice to the Attorney General is required when a breach affects more than 500 Delaware residents.

Note: the count is Delaware residents only, not a total.

Delaware breach-notification register ↗

Unverified claim

US — Ransomware Attack

This is an unverified claim — it has allegedly happened to this organisation, as posted by a source below, but has not been confirmed by a regulator, a court filing or the organisation’s own disclosure.

Timeline

December 22, 2022
Claimed by threat actor (unverified) Claim
Ransomware leak-site claim (ransomware_live)
^source

Sources

Timeline

Timeline

Timeline

Related

Same sector and location

Disclosed around the same time

Named on a leak site