The Peninsula Corridor Joint Powers Board, the agency that operates Caltrain, filed a data breach notice with the California Attorney General regarding an unauthorized access incident at a third-party vendor. The vendor, Turbo Data Systems, handles citation payment processing for public agencies. Unauthorized access to citation payment files reportedly occurred around November 21, 2024, and the vendor determined personal information may have been compromised around November 21, 2025.
According to regulatory filings, 347 individuals were affected by the breach. The compromised data types included names and Social Security numbers. No financial account numbers, credit card details, or medical records were confirmed to have been exposed in the incident.
Notification letters were prepared under sample dates in late October 2026, and the formal filing was submitted to the California Attorney General on November 3, 2026. Because vendor investigations can uncover additional details over time, official assessments may be updated as further information becomes available.