Toronto Transit Commission

History

2021: Ransomware Virus Attack

In early November 2021, information appeared that the ransomware virus attack disrupted the activities of the Toronto public transport agency in Canada Toronto Transit Commission (TTC), and also disabled several systems used by both drivers and passengers. At the time of writing, none of the gangs distributing extortion programs claimed responsibility for the incident.

The company reported that the attack was discovered on October 28, 2021 in the evening and was identified by an IT employee of the Toronto Transportation Commission. According to TTC spokesman Stuart Green, the incident affected the agency's internal email server and TTC Vision, a video communication system with drivers. In this regard, the replacement procedure with a classic radio-based communication system has been activated. In addition to internal TTC systems, the incident also affected servers working with customers, and the booking portal for Wheel-Trans, a vehicle for people with disabilities, is still not working on November 2, 2021.

Ransomware virus blocked public transport operator's IT systems

This attack affected the ability to display information about TTC vehicles in real time on the screens of station platforms, in travel planning applications and on the TTC website. Despite this incident in Toronto, public transport routes were not disrupted. Buses, trams and subway trains continued to run as usual, Canadian officials said.

Among other attacks using ransomware viruses that hit public transport systems from 2019 to 2021 are attacks on:

• MUNI in San Francisco in November 2016;
• Sacramento Regional Transit in November 2017;
• Trinity Metro in Fort Worth in July 2020;
• SEPTA in Philadelphia in October 2020;
• Ann Arbor Area Transportation Authority in October 2021.

According to experts, in most cases, ransomware viruses enter the system through the launch of an infected.exe file in an email or when downloading, after which it encrypts data with a randomly generated key and spreads to other systems on the network. None of these attacks ever disrupted public transport, since state agencies usually managed to execute routes on time and even without the help of computer systems.^[1]

Notes