Analyst assessment
A June 15, 2024, intrusion into Oahu Transit Services’ network disrupted digital services supporting Honolulu’s TheBus and TheHandi-Van. Officials confirmed an outside intrusion and disconnected systems to contain it. Bus and paratransit operations continued, while websites, arrival information and electronic fare collection were affected. Cyber involvement and operational disruption are confirmed; the public evidence does not establish ransomware encryption or independently authenticate the claimed operator.
The city’s June 24 restoration notice says real-time GPS information and HOLO card readers were operating normally again. This was a June 2024 incident, separate from the operator’s December 2021 attack.
Operational significance
The operator’s June 15 notice reported computer and telephone failures affecting its websites, transit-information and paratransit lines, and GPS-based apps. Updates that day announced that telephone services were available again while online services remained down.
According to KHON2’s June 18 report, officials placed the initial disruption at about 1 a.m. June 15, Hawaii time. Transportation Director Roger Morton said street-level bus and paratransit service had returned to normal by that afternoon. Some digital connections remained disconnected to protect systems and data.
The affected functions included the transit websites, telephone connections, real-time arrival and GPS information, and HOLO card readers. Riders could show their HOLO cards to operators as proof of fare while readers were unavailable. The distinction between continued vehicle service and impaired passenger technology is central: this was a substantial digital-service interruption, without evidence that the entire transit system stopped.
By June 21, the websites were back online, but GPS information and HOLO readers remained unavailable. The June 24 city notice confirmed those functions had resumed. It also said riders could again tap their cards and use arrival apps. These statements support resolution of the documented material disruption by June 24, while leaving the precise timing of every internal repair unknown.
A Nov. 27, 2024, Honolulu Star-Advertiser report republished by Transit Talent quoted OTS estimating about $100,000 in lost fare revenue using data from the city’s HOLO contractor. It also described continuing security improvements. The Federal Transit Administration’s event record lists $229,921 in its property-damage field. The figures describe different categories and should not be added together or treated as interchangeable estimates of lost fares.
Confidence and uncertainty
Confidence is high in the intrusion and service-impact findings because the city’s own notice and named officials’ statements corroborate them. June 17 reporting initially described a network outage and reported a ransomware allegation from Falcon Feeds. The following day’s reporting quoted Morton describing an outside intrusion.
The city said the HOLO server was unaffected and registered HOLO card information was not compromised. OTS believed an older database used to print bus passes might have been accessed, potentially involving names and addresses. Officials said financial information and government identifiers, including Social Security numbers, were not believed compromised. These attributed findings are narrower than confirmation that every category appearing in an alleged database was populated or stolen.
A DragonForce-associated claim indexed by ransomware.live alleged possession of about 800,000 records and threatened consequences if the organization did not make contact. The allegation does not establish a count of affected people.
Analytic gaps
Contemporary reporting on the claim included the monitor’s uncertainty about whether the posting represented the genuine group or an impersonator. Reports and the indexed text also described different payment deadlines. Operator attribution therefore has low confidence, and the specific mechanism remains unresolved.
Morton said June 18 that no ransom had been paid and that paying would violate policy. In the later Star-Advertiser report, an OTS spokesperson also denied that any ransom had been paid for the June breach. These are attributed statements, rather than an independent audit of payments. The public record does not establish the initial-access method, encryption scope, a verified complete data release or the final extent of copied information. Later security work or financial accounting does not independently extend the June service outage.
The federal record dates the event June 14 at 11:40 p.m., while the city’s restoration notice identifies June 15. That discrepancy remains unresolved; the registry retains the city’s June 15 date. The federal entry’s brief description mentions purchased IT items and overtime but does not provide a usable breakdown of the reported costs.
