Incident · State breach notice (California AG)
Caltrain Citation Payment Vendor Notifies Residents of 2024 Data Event
Published . By the cisonews.net Desk.
What happened and when
Turbo Data Systems, which provides citation payment processing services for agencies including Caltrain, filed a notice with the California Attorney General describing a data event tied to its network. The notice states files tied to citation payment services may have been accessed without permission around a specific date in November 2024. Turbo Data Systems states it determined on November 21, 2025 that a recipient's information may have been involved in the event.
What information was involved
The notice states the information that may have been involved included a name and Social Security number. Turbo Data Systems states it has no evidence that this information was used to commit identity theft or fraud. The notice does not state how many Caltrain-linked individuals were affected, using placeholder text in place of a specific count.
What the organization is offering recipients
Turbo Data Systems states it is providing complimentary credit monitoring and identity protection services, including a $1,000,000 identity theft insurance policy at no charge. These services include credit file alerts for 12 months from the date of enrollment. The notice states recipients must enroll within 90 days of the date of the letter to receive these monitoring services. Turbo Data Systems also states it notified the FBI and will cooperate with any resulting investigation.
What the notice leaves open
The notice does not state the specific number of Caltrain-related individuals affected by this event. It also does not describe how the network disruption occurred or what specific files beyond citation payment records may have been involved. The notice does not state whether any regulatory investigation beyond FBI notification is underway.
How this disclosure's timing compares
Caltrain disclosed 347 days after the discovery date its notice gives. Across the 50 other state breach notices on cisonews.net that date discovery to the day, the median gap is 72 days.
California's breach-notice rule
California's breach law (Civil Code § 1798.82 for businesses, § 1798.29 for state agencies) requires any person or business that must notify more than 500 California residents of a single breach to submit one sample copy of that notice to the Attorney General electronically. The California Attorney General's breach list, where this notice was found, is built from those submissions. Source: California Department of Justice, Office of the Attorney General, Data Security Breach Reporting. The guide Data breach notification laws by state: thirteen states, read directly reads the rule in full, and the glossary defines Breach notification law.
Other transportation & logistics incidents on cisonews.net
- STS Aviation Group, Breach notice, first disclosed October 19, 2026
- Zoomcar Holdings, 8-K Item 1.05, first disclosed June 13, 2025
- Radiant Logistics, 8-K Item 1.05, first disclosed March 20, 2024
- Expeditors International of Washington, 8-K Item 8.01, first disclosed February 22, 2022
Sources
- 2026-11-03 · APeninsula Corridor Joint Powers Board (Caltrain), notice filed with the California Attorney General, published November 3, 2026
- 2026-11-03 · ACalifornia Attorney General, data breach notification record, published November 3, 2026
- undated · ACalifornia Department of Justice, Office of the Attorney General, Data Security Breach Reporting
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.