Unauthorized access disrupted Maryland Transit Administration paratransit scheduling, call centers and rider information in August 2025. State records documented residual information-system effects into February 2026; Rhysida’s claim remains unverified.
Unauthorized access to systems, accounts, networks, or data.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Services remained available but with reduced performance, reliability, functionality, capacity, or responsiveness.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
Dispatch, routing, assignment, coordination, or response-management functions were unavailable or materially impaired.
Transit, aviation, rail, maritime, logistics, fleet, traffic, ticketing, or related transportation operations were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
An authoritative source stated that no ransom or extortion payment was made.
Unauthorized access disrupted Maryland Transit Administration scheduling, call-center and rider-information systems in August 2025. The agency confirmed incident-related data loss, but did not publicly identify affected data categories, the entry method or an attacker. Rhysida’s separate extortion claim remains unverified attribution.
State procurement records place MTA’s discovery on Aug. 21. We reported that the agency acknowledged the incident Aug. 24 and could not accept new Mobility bookings or rebookings, although previously scheduled trips would be honored. These are distinct discovery and public-disclosure dates; the precise intrusion start is unknown.
The disruption affected access to transportation for riders with disabilities, rather than shutting down the entire transit network. Core bus and rail services continued. MTA introduced interim telephone reservations through MV Transportation on Aug. 29 and arranged additional medical-transport support.
Later procurement documentation identifies compromised Trapeze PASS and Ranger environments supporting reservations, dispatch and vehicle oversight. Recovery moved affected functions to cloud hosting and addressed reduced-fare application backlogs from August through November 2025. MV’s role as an existing operator and recovery contractor does not establish that it caused the intrusion.
Recovery extended beyond the initial restoration of bookings. A legislative budget analysis reported that, as of Feb. 1, 2026, services were operating normally except for residual Metro and light-rail signage and real-time information problems. A recovery contract’s term or spending ceiling does not establish the duration of those problems or actual incident expenditure.
Confidence is high in unauthorized access and operational disruption because MTA and state records explicitly document them. Confirmed data loss does not establish whether particular records were stolen, destroyed or otherwise lost.
The Record reported that Rhysida claimed the incident and demanded 30 bitcoin with a seven-day deadline. Alleged stolen document types and samples remain attacker claims. This supports medium confidence in ransomware-related extortion and low confidence in the named actor’s responsibility; reviewed official evidence does not establish encryption.
A state technology spokesperson said no ransom had been paid as of the Oct. 1 report. Its broad restoration wording is qualified by remaining information-system effects described in that report and the later legislative analysis.
The initial access technique, exact intrusion start, affected record types and population, confirmed exfiltration, encryption, attacker identity and complete operational-restoration date remain unestablished. No incident-specific phishing finding follows from MTA’s general security advice.
The live Mobility page still describes an interim reservation system with some unavailable reminder and confirmation features. That undated section does not explicitly connect these particular limits to this incident. The September 2026 procurement request documents continuity arrangements and a prospective contract-expiration risk, rather than a new observed outage. Neither alone establishes continuous incident-related disruption through the research cutoff.
Operations are presumed resolved based on elapsed time since the Feb. 1, 2026 observation of residual information-system effects. Positive evidence of complete recovery remains absent. The exact end date remains unverified; containment, interim reservations and an undated webpage do not establish complete recovery.
Rhysida claimed the broader MDOT name in connection with the MTA incident. The Record reported a 30-bitcoin demand, seven-day deadline and alleged stolen document samples on Sept. 24, 2025. Official evidence confirms MTA unauthorized access and unspecified data loss, but not this actor, encryption or the claimed stolen document types. Aggregator discovery time is distinct from original claim publication; no stolen documents were accessed.
Baltimore is the administrative site anchor for the affected state transit agency. It is an independent city; this relationship does not assert every local route or service was interrupted.
Maryland supplies the governmental service context for the state transit agency’s multimodal operations and statewide support mandate. It does not imply all routes, all local transit operators or the whole state experienced an outage.
Our report documented MTA’s Aug. 24 acknowledgment and unavailable new Mobility bookings, rider information and call-center functions.
MTA confirmed unauthorized access and incident-related data loss, interim Mobility scheduling through MV Transportation, and remaining information and call-center effects.
MTA’s spokesperson confirmed unspecified data loss; Rhysida separately claimed the incident and demanded 30 bitcoin.
State technology spokesperson Nathan Miller said Maryland had not paid a ransom.
MTA is an MDOT division operating multimodal transit and supporting local transit systems across Maryland.
MTA first learned of potential unauthorized access Aug. 21 and reported an emergency business and technology recovery contract with a $10 million ceiling.
MTA attributed migration of Trapeze PASS, Ranger and call-center functions to the August 2025 compromise and sought a successor cloud-hosting contract.
The official contact page lists MTA at 6 St. Paul St., Baltimore, Maryland.
The cybersecurity section reports normal service as of Feb. 1, 2026, except residual Metro and light-rail signage and real-time information issues.
The live page describes interim reservations with booking and cancellation available, but reminder calls, vehicle-arrival calls and email trip confirmations unavailable.
Signed-in members can report an error, update, or missing source.
