The Peninsula Corridor Joint Powers Board, which operates the Caltrain commuter rail service, submitted a data breach notification to the California Attorney General regarding a cybersecurity incident involving third-party vendor Turbo Data Systems. Unauthorized access to citation-payment files maintained by the vendor occurred around November 21, 2024. The vendor determined on November 21, 2025, that personal information associated with Caltrain citation records may have been compromised.
The compromised records included individuals' names and Social Security numbers. Official filings did not disclose the total number of individuals impacted or whether financial account information was accessed beyond the citation records.
The California Attorney General received the notification filing in November 2026. The full scope of affected individuals and jurisdictions has not been publicly confirmed as investigation details continue to be reviewed.