Overview
- Gambit Security published a report Tuesday saying it found roughly 700 gigabytes of LACMTA emails, backups and files that were exfiltrated in the March intrusion and later exposed online.
- The intrusion was detected around March 16 and disabled some customer-facing systems such as arrival screens and fare reload functions while trains and buses continued to run.
- Gambit's forensic analysis ties the server that held the stolen data to infrastructure and activity previously linked to Iran and to operations attributed to Iran’s Ministry of Intelligence and State Security by Israel’s cyber directorate.
- The FBI says it is coordinating with partners on the incident, and LACMTA continues system recovery work while declining to speculate on attribution as investigations proceed.
- Security firms and reporters place the breach in a broader uptick of alleged Iran-linked cyber operations since late February, a trend that raises fresh concerns about attacks on U.S. critical infrastructure and could prompt expanded defensive measures and investigations.