Skip to content
DysruptionHub
Sign in Subscribe

Ransomware disrupts Pittsburgh Regional Transit rail and customer services

Summary

Pittsburgh Regional Transit logo

A Dec. 19, 2024, ransomware attack disrupted Pittsburgh Regional Transit’s rail control and customer-service systems. Rail operations recovered that morning, but other systems required further restoration, and personal information was stolen.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
High
Attribution:
Unresolved

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Remote access disruption

    VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Transportation operations disrupted

    Transit, aviation, rail, maritime, logistics, fleet, traffic, ticketing, or related transportation operations were materially affected.

  • Supply chain disruption

    Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

What happened

Pittsburgh Regional Transit detected ransomware on its computer network Dec. 19, 2024, after rail-control computers lost the ability to display train locations. The agency activated its cyber incident response team, notified law enforcement and engaged outside specialists. It publicly identified the incident as ransomware Dec. 23.

Spokesperson Adam Brandolph told the Pittsburgh Union Progress that the rail-control problem began about 4:30 a.m. and was cleared by about 7 a.m. Dec. 19. Recovery of rail control did not end the disruption to other agency systems.

Operational significance

WESA’s contemporaneous reporting described 20- to 30-minute light-rail delays and the loss of remote tracking and station announcements. Customer-service phones remained available. Processing for Senior and Kids ConnectCards was affected, while ordinary card loading and vehicle tracking were working by the original Ghost-linked report. Customer-service staff recorded problems by hand and could not work remotely.

The agency’s Federal Transit Administration incident report describes a temporary tunnel closure involving a gate-management server, affected trip-planning and card-printing services, and disruption to procurement and internal systems. It says most affected systems were restored from backups and some endpoints were rebuilt. All affected systems and services were operational by the time of that report, which does not specify the final restoration day.

Confidence and uncertainty

The agency’s acknowledgment and federal incident report establish ransomware, operational disruption and acquisition of personal information. Investigators identified personal-information involvement Dec. 27. A Jan. 8 follow-up interview reported at least 69 current or former employees and applicants affected at that point, including Social Security and driver’s license numbers. That was an initial count during an ongoing review.

Early statements that rider information had not been compromised were provisional and addressed a different population from the later employee and applicant findings. Brandolph did not disclose whether a ransom had been paid.

Analytic gaps

The initial entry method, responsible operator, full access period and final number of affected people remain unresolved in the reviewed evidence. The exact restoration dates for customer-service and internal systems are also unknown. The federal report does not name the affected tunnel; the separately reported Mon Incline outage should not be attributed to this cyberattack without evidence.

Threat actor and claim

Organizations involved

Impacted locations

  • Pittsburgh Regional Transit service area, Pennsylvania

    Medium Confidence

    The agency’s official 2025 bus-stop guidance describes a 775-square-mile service area within and immediately adjacent to Allegheny County. Reuse of the city or county polygon would misstate that scope. This explicitly unmapped public-transit service area represents the affected agency’s geographic remit, not a uniform outage at every stop or household. The brief rail-control interruption and longer customer-service/internal-system effects remain separately documented. No stop walkshed, paratransit eligibility buffer or entire county boundary is substituted for the overall transit service area.

    Source

  • Pittsburgh, Pennsylvania

    Pittsburgh contains the agency’s verified administrative office and customer-service center. The official FTA record describes disruption to customer-service trip planning and Senior/Kids card printing, procurement and internal systems. This municipality is the supported physical anchor; it does not establish an outage at every city government department or every transit facility.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.