Caltrain Data Breach: Social Security Numbers Exposed

Caltrain, a commuter rail service operating along the San Francisco Peninsula and through the South Bay to San Jose and Gilroy, was affected by a data breach through its vendor, Turbo Data Systems (TDS).

TDS provides citation payment processing services for agencies and municipalities throughout California, including Caltrain, which is owned and governed by the Peninsula Corridor Joint Powers Board.

In November 2024, TDS experienced a network disruption that interrupted its services. TDS launched an investigation with the support of cybersecurity specialists.

The investigation found that some files related to citation payment services may have been accessed without authorization around Nov. 21, 2024.

TDS then conducted a review to identify the specific information that was present in those files and to determine which individuals needed to be notified. On Nov. 21, 2025, roughly one year after the incident occurred, TDS learned that some personal information may have been involved.

The personal information exposed included names and Social Security numbers.

The breach was disclosed to the California Attorney General on Nov. 3, 2026. TDS notified affected individuals by written notice beginning in September 2026.

Turbo Data Systems' response to the breach

TDS is offering affected individuals 12 months of complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company.

To enroll, affected individuals can visit the Cyberscout enrollment page and enter the unique code included in their notification letter. Enrollment must be completed within 90 days from the date of the letter.

For questions or additional assistance, affected individuals can call 1-877-344-7618, Monday through Friday from 8:00 a.m. to 8:00 p.m. ET, excluding holidays.