IT Curves Faces Unverified Cyberattack Claim After Maryland Transit Disruption
Summary
Allegany County reported trip-confirmation disruption tied to a third-party scheduling vendor. Ababil of Minab claimed IT Curves was hacked, but neither the vendor nor the county confirmed its identity or the alleged compromise and data theft.
Key points
- A May 6 county notice told riders with May 6 and 7 pickups to call Allegany County Transit to confirm trips after a cybersecurity incident involving a third-party scheduling vendor.
- The county did not name the vendor; the article identifies IT Curves as a likely connection, but neither the county nor the company confirmed that link.
- Ababil of Minab claimed on June 9 that it hacked IT Curves, alleging 20 critical machines were compromised, 20 TB of data wiped and 2 TB exfiltrated; these claims were not independently verified.
- Gambit Security linked the persona to a broader destructive transportation-sector campaign, but said that context does not verify the IT Curves claim.
- IT Curves, Allegany County and law enforcement had not confirmed data theft, data wiping, affected-system counts or the threat actor. The scope and restoration status remained unclear.
Article Details
- Victim Organization
- IT Curves (the alleged target; the company and Allegany County have not confirmed that IT Curves was the vendor involved)
- Incident Type
- Unconfirmed cyberattack claim involving an alleged compromise of IT Curves systems, data wiping, and data exfiltration. Separately, Allegany County documented a scheduling-vendor-related disruption to paratransit trip confirmations.
- Data Types Exposed
- Sensitive data (type unspecified; exfiltration was claimed but not independently verified)
- Affected Data Size
- Ababil of Minab claimed approximately 20 TB of data was wiped and approximately 2 TB of sensitive data was exfiltrated; these claims have not been independently verified.
- Operational Impact
- Allegany County said riders with May 6 and May 7 pickups had to call Transit to confirm trips because of a cybersecurity incident involving a third-party scheduling vendor. The county did not report missed trips or confirm that IT Curves was the vendor. The wider system impact is unknown.
- Ransom Or Extortion
- Unknown; no ransom or extortion demand is reported.
- Claim Status
- claimed
MITRE ATT&CK
Threat Actors
Ababil of MinabA persona using this name claimed on June 9 that it hacked IT Curves and alleged system compromise, data wiping, and exfiltration. The claims have not been independently verified. Gambit Security described the persona as pro-Iranian and said its activity overlapped with infrastructure and operations previously tied by Israel’s National Cyber Directorate to Iran’s Ministry of Intelligence and Security; this does not confirm responsibility for the IT Curves claim.Iran’s Ministry of Intelligence and SecurityGambit Security said the campaign’s infrastructure and operations overlapped with activity previously tied by Israel’s National Cyber Directorate to Iran’s Ministry of Intelligence and Security. The article does not establish that the ministry was responsible for the claimed IT Curves attack.