A data breach notice has been filed with the California Attorney General under the name of the Peninsula Corridor Joint Powers Board, the agency that operates Caltrain. The notice describes an incident at Turbo Data Systems, a vendor that processes citation payments for public agencies, and says that names and Social Security numbers may have been involved.
Public agencies and the vendors they hire collect and store sensitive information about the people they serve. They carry a responsibility to protect that information, and people whose data is exposed deserve clear answers about what happened and what comes next.
Caltrain’s Data Breach Investigation
The sample notice filed with the California Attorney General on behalf of the Peninsula Corridor Joint Powers Board, known publicly as Caltrain, is a template prepared by Turbo Data Systems, which the notice abbreviates as TDS. According to the notice, TDS provides processing services for agencies and municipalities throughout California. The template leaves the name of the agency as a blank placeholder, so the public filing itself does not spell out how Caltrain’s records connect to the vendor, but the filing was submitted under Caltrain’s name and the California Attorney General lists it that way.
The notice states that TDS experienced a network disruption in November 2024 that interrupted its services. TDS says it investigated right away with help from cybersecurity specialists, and concluded that some files related to citation payment services may have been accessed without authorization around November 21, 2024. The company then carried out what it calls a comprehensive review to work out exactly what information was present in those files and whose it was.
That review took a long time. TDS states that on November 21, 2025, it learned that some individuals’ information may have been involved, which is the reason for the notification. After finishing the review, the vendor worked with the agency to confirm contact information so that letters could be sent. The notice also states that TDS notified the FBI and will cooperate with any resulting investigation, and that it has no evidence that any of the information was used to commit identity theft or fraud.
The notice does not say how many people were affected, and the filing leaves the number of residents in at least one state as an unfilled placeholder. Caltrain’s own role is also not described in detail. Until the agency, the vendor or a regulator publishes more information, the total number of affected people remains unknown, and this page will not guess at one.
Incidents involving a third-party vendor are a familiar pattern in modern data breaches. When a government agency hires a company to process payments, citations or similar records, a copy of the relevant personal information often ends up on that company’s systems. The agency may never see the vendor’s network, yet people who interacted with the agency can still be affected if the vendor is compromised. That is why many breach notices come from an organization that is not the one that suffered the intrusion, and why the sender’s name on a letter does not always match the company whose systems were involved.
The timeline described in the notice also deserves attention. The files were accessed around November 21, 2024, but the vendor says it determined that individual information may have been involved on November 21, 2025, and the filing with the California Attorney General is dated November 3, 2026. Long gaps between an intrusion and a notice leave affected people exposed for an extended period without knowing it, which makes it more important to act promptly once a letter finally arrives.
Names paired with Social Security numbers are the combination fraudsters value most. With both, a criminal can try to open credit accounts, file false tax returns, apply for benefits or impersonate the victim to a bank or employer. Because a Social Security number rarely changes, the risk does not end when a credit monitoring offer expires. Anyone who receives this notice should read it carefully, enroll in the services offered, and monitor their accounts, even though TDS says it has seen no evidence of misuse.
People who paid or contested a citation processed by a California agency or municipality, and who receive a letter referencing Turbo Data Systems, should keep it. Those who are unsure whether they were affected can contact the number in their letter or the agency that issued the citation to ask whether their information was included.
When Did This Breach Occur?
According to the notice, TDS experienced a network disruption in November 2024, and files related to citation payment services may have been accessed without authorization around November 21, 2024. TDS states that it determined on November 21, 2025, that some individuals’ information may have been involved.
The sample notice was reported to the California Attorney General on November 3, 2026. The Attorney General’s listing shows no specific breach date for the filing. Recipients of the notice have 90 days from the date of their letter to enroll in the complimentary credit monitoring offer, so they should act quickly after receiving it.
What Information Was Breached?
TDS states that the information may have included each affected person’s name and Social Security number. The company states that it has no evidence any of this information was used to commit identity theft or fraud. The notice does not list any other categories of personal information.
Because the notice describes files tied to citation payment services, the records may relate to people who paid or handled parking or other citations. The notice does not confirm which specific individuals or which agency customers were involved beyond the entity named on the filing.
What You Can Do
Whether or not you have received a letter, taking a few protective steps is sensible after any exposure of your Social Security number:
- Enroll in the complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company, using the code and instructions in your letter. TDS says the services provide alerts for 12 months from enrollment.
- Review your credit reports from all three nationwide credit bureaus, which you can request for free at annualcreditreport.com, and look for accounts or inquiries you do not recognize.
- Consider placing a fraud alert or a security freeze on your credit file. A freeze is free and blocks new creditors from viewing your file without your consent.
- Watch your bank, card and tax accounts for unfamiliar activity, and consider requesting an IRS Identity Protection PIN to help prevent false tax filings.
- Be wary of unexpected emails, calls or texts that mention your Social Security number or a past citation, and do not click links in messages you did not expect.
If you discover that someone has misused your information, report it to the Federal Trade Commission at identitytheft.gov, file a police report, and notify the affected financial institutions right away.
File a Data Breach Lawsuit Against Caltrain
People whose Social Security numbers were exposed through a vendor of a public agency may have legal options. Lawsuits over data exposure commonly allege that an organization failed to use reasonable safeguards to protect sensitive information, and they can seek compensation for the time, expense and risk that affected individuals face. Whether a claim is available depends on the specific facts of the incident and where the affected person lives, which is why speaking with a qualified attorney is the best way to understand your rights.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
