Iranian Hackers Linked to Los Angeles Transit System Breach

Iranian hackers disrupted Los Angeles’ transit system in March, causing shutdowns of parts of its network. Israeli researchers from Gambit Security discovered that at least 700 gigabytes of data were stolen. This included emails, backups, and other files from the Los Angeles County Metropolitan Transportation Authority (LACMTA). The breach traces back to a known hacking group linked to Tehran.

The Iranian mission to the UN did not comment, nor did Israel’s National Cyber Directorate. The Los Angeles transit authority is collaborating with law enforcement and cybersecurity experts. They have yet to speculate on who is responsible for the breach.

A pro-Iran group called Ababil of Minab claimed responsibility and has characteristics of vigilante hacker groups used by Iranian spies, according to U.S. and Israeli researchers. Eyal Sela, director of threat intelligence at Gambit, confirmed forensic evidence supports this connection.

Gambit, with roots in Israel’s Unit 8200, has alerted relevant authorities. Ababil has not responded to messages, and the FBI is coordinating a response. The cybersecurity agency CISA did not comment.

The breach was identified around March 16 and involved Ababil claiming the destruction of data in a cyberattack. Los Angeles transit operations were not halted; however, some screens were disabled, and customers faced difficulties topping up transit cards.

Ababil has also targeted other systems, including South Florida’s Tri-Rail, Vyncs, and Saudi’s Unimac. Tri-Rail confirmed a breach without critical data loss. Vyncs detected a breach on April 2, but specifics are undisclosed. The FBI is investigating these incidents.

Gambit Security states that Ababil has targeted a media organization and educational institution in Israel, plus a Turkish insurance brokerage, keeping identities confidential.

Iranian hackers have reportedly increased digital attacks following perceived conflicts with the U.S. and Israel. This includes attacks on Stryker and leaking emails of FBI Director Kash Patel. Iranian hackers might have also tampered with fuel gauges at gas stations, as reported by CNN.