Skip to content
cisonews.net

Incident · State breach notice (California AG)

Caltrain Citation Payment Vendor Notifies Residents of 2024 Data Event

Published . By the cisonews.net Desk.

What happened and when

Turbo Data Systems, which provides citation payment processing services for agencies including Caltrain, filed a notice with the California Attorney General describing a data event tied to its network. The notice states files tied to citation payment services may have been accessed without permission around a specific date in November 2024. Turbo Data Systems states it determined on November 21, 2025 that a recipient's information may have been involved in the event.

What information was involved

The notice states the information that may have been involved included a name and Social Security number. Turbo Data Systems states it has no evidence that this information was used to commit identity theft or fraud. The notice does not state how many Caltrain-linked individuals were affected, using placeholder text in place of a specific count.

What the organization is offering recipients

Turbo Data Systems states it is providing complimentary credit monitoring and identity protection services, including a $1,000,000 identity theft insurance policy at no charge. These services include credit file alerts for 12 months from the date of enrollment. The notice states recipients must enroll within 90 days of the date of the letter to receive these monitoring services. Turbo Data Systems also states it notified the FBI and will cooperate with any resulting investigation.

What the notice leaves open

The notice does not state the specific number of Caltrain-related individuals affected by this event. It also does not describe how the network disruption occurred or what specific files beyond citation payment records may have been involved. The notice does not state whether any regulatory investigation beyond FBI notification is underway.

How this disclosure's timing compares

Caltrain disclosed 347 days after the discovery date its notice gives. Across the 50 other state breach notices on cisonews.net that date discovery to the day, the median gap is 72 days.

California's breach-notice rule

California's breach law (Civil Code § 1798.82 for businesses, § 1798.29 for state agencies) requires any person or business that must notify more than 500 California residents of a single breach to submit one sample copy of that notice to the Attorney General electronically. The California Attorney General's breach list, where this notice was found, is built from those submissions. Source: California Department of Justice, Office of the Attorney General, Data Security Breach Reporting. The guide Data breach notification laws by state: thirteen states, read directly reads the rule in full, and the glossary defines Breach notification law.

Other transportation & logistics incidents on cisonews.net

All transportation & logistics incidents

Sources

  1. 2026-11-03 · APeninsula Corridor Joint Powers Board (Caltrain), notice filed with the California Attorney General, published November 3, 2026
  2. 2026-11-03 · ACalifornia Attorney General, data breach notification record, published November 3, 2026
  3. undated · ACalifornia Department of Justice, Office of the Attorney General, Data Security Breach Reporting

Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.