San Francisco Municipal Railway computer systems hacked in a Ransomware attack and the authorities had to give away free rides all day long to its customers, on Saturday last week.
The San Francisco Municipal Transporation Agency (SFMTA) gave free service on its Metro light-rail all day long, on Saturday, after an apparent ransomware hack of the agency’s computer systems.
Pink ‘out of service’ notification showed on ticket machines at Powell Street station, where operators taped paper signs which read ‘Metro Free.’
San Francisco Municipal Railway (MUNI) spokesperson confirmed the news of the hack and administration had to shut down their systems and “opened the fare gates as a precaution to minimize customer impact.”
“There’s no impact to the transit service, but we have opened the fare gates as a precaution to minimize customer impact,” said Muni spokesman. “Because this is an ongoing investigation it would not be appropriate to provide additional details at this point.”
The station screens displayed a message that reads:
“You Hacked, ALL Data Encrypted. Contact For Key([email protected])ID:681 ,Enter.”
The Verge contacted the hackers via email which confirmed that he was seeking a deal with MUNI to remove the ransomware:
“we don’t pay attention to interview and propagate news ! our software working completely automatically and we don’t have targeted attack to anywhere! SFMTA network was Very Open and 2000 Server/PC infected by software! So we are waiting for contact any responsible person in SFMTA, but I think they don’t want a deal! So we close this email tomorrow!”
The hacker demanded 100 BTC ($73,184 USD) with current exchange rates.
However, SFMTA had no intention of paying the ransomware. On its website blog, it reads: “The SFMTA has never considered paying the ransom. We have an information technology team in place that can restore our systems, and that is what they are doing.”
Morphus Labs mentioned the same hacker in September in a link to a strain of ransomware called Mamba, which uses similar tactics to those used against MUNI.
At the time of the attack, experts at transit had no idea who was responsible for the cyber attack.
According to San Francisco Municipal Railway blog, “Upon discovering the malware, we immediately contacted the Department of Homeland Security (DHS) to identify and contain the virus. We are working closely with the FBI and DHS on this matter.”
Moreover, it reads, “Existing backup systems allowed us to get most affected computers up and running this morning, and our information technology team anticipates having the remaining computers functional in the next day or two.”
Photo: SFMTA
Share this article
About the Author
Peter Buttler an Infosec Journalist and Tech Reporter, Member of IDG Network. In 2011, he completed Masters in Cybersecurity and technology. He worked for leading security and tech giants as Staff Writer. Currently, he contributes to a number of online publications, including The Next Web, CSO Online, Infosecurity Mag, SC Magazine, Tripwire, GlobalSign CSO Australia, etc. His favorite areas Online Privacy, AI, IoT, VR, Blockchain, Big Data, ML, Fintech, etc. You can follow him on twitter.
More from Peter ButtlerRelated Posts
Google and FBI Disrupt NetNut Residential Proxy Network Used by 2M+ Devices
Google worked with the FBI and Lumen to disrupt the NetNut residential proxy network, also known as ...
Opera Launches Paste Protect to Block ClickFix Clipboard Attacks
Opera’s Paste Protect blocks harmful commands from reaching the clipboard, preventing ClickFix...
Reddit Introduces Mandatory Age Verification for EU Teens Accessing NSFW Content
Reddit will require European Union users under 18 to verify their age before viewing mature or NSFW ...
Popular ‘Adblock for YouTube’ Chrome Extension Found With Remote Code Execution Risk
The popular “Adblock for YouTube” Chrome extension now carries an architectural weakness...
Texas Hunting and Fishing License Data Breach Affects 3 Million Customers
Approximately 3 million Texas hunting and fishing license customers were affected by a data breach i...
FBI Warns of ‘Kali365’ Subscription Service Targeting Microsoft 365 Accounts
The FBI’s sounding the alarm on Kali365, a site where criminals can pick up ready-to-use tools for s...
