Los Angeles Metro Restricts Internal Systems After Unauthorized Activity
Summary
Los Angeles Metro says it restricted internal administrative systems after detecting unauthorized activity. Some arrival screens and TAP reload options were disrupted; Metro says transit operations continued and customer and employee data were not affected.
Key points
- Metro said its security team detected unauthorized activity and restricted access to internal administrative computers as a containment step.
- Some station monitors could not display arrival times, and riders were warned of problems reloading TAP cards online or by phone.
- Metro advised riders to use ticket vending machines to buy or reload fares; one rider reported unsuccessful vending-machine and mobile-payment attempts.
- Metro said bus and rail operations continued and customer and employee data were not affected; it was working to restore access to impacted systems.
- Metro has not identified who was responsible, and no group has publicly claimed the incident.
- ransomware[.]live separately listed the City of Los Angeles as a Worldleaks victim; Metro did not link its system restrictions to that listing.
Article Details
- Victim Organization
- Los Angeles Metro
- Incident Type
- Unauthorized activity involving internal administrative computer systems; the specific method was not disclosed.
- Operational Impact
- Metro restricted access to internal administrative computers as a containment measure. Some station monitors could not display arrival times, and riders experienced problems with fare loading through the website, customer service lines, and TAP Mobile App. Bus and rail operations continued. Metro said customer and employee data were not impacted.
- Ransom Or Extortion
- No ransom or extortion activity was reported for Metro. Separately, ransomware.live listed the City of Los Angeles as a victim of the Worldleaks group; Metro did not link its incident to that listing.
- Claim Status
- confirmed