Toronto's Transport Network Attacked with Ransomware
A new ransomware attack took place last week and was reported over the weekend. The city of Toronto's Transit Commission - the entity in charge of the city's public transport, released a statement informing the public of a ransomware attack.
According to the formal Toronto Transit Commission statement, the initial impact of the attack was "minimal" until mid-Friday and it started as the standard "unusual network activity". Once the attack was in full swing, Toronto's public transport service lost access to a range of services and functionality.
The standard communication system used by public transport operators went down and they were forced to communicate using radio. Additionally, email servers went down and information about arrival times and "next vehicle" displays were also lost, as well as the ability to book transport online.
There is no hard information about the identity of the ransomware gang responsible for the attack, and none of the big ransomware names have posted a boast on their blogs yet.
The Toronto Transit Commission has involved all the respective authorities in the matter and is "investigating" the incident.
This is not the first time a Canadian subway network was attacked by ransomware gangs in recent years. Both Montreal and Vancouver suffered similar hacker attacks, with ransomware involved, with both attacks taking place in late 2020.
There has been a lot of heated debate over how authorities and victims should handle ransomware attacks and cooperate to fight them in the United States as well. A controversial bill was recently introduced as a bicameral effort in the US senate, suggesting measures intended to limit the impact of ransomware that some found too burdensome and stringent.
US legislators and companies are both trying to figure out a way to limit both the exposure of entities to attack, as well as the impact of those attacks and the possible payments made to cyber extortionists. The ransomware landscape in the US changed dramatically following the mid-2021 attack on Colonial Pipeline that had a major impact on a large portion of the country and affected numerous states.
In more recent events, a Russian ransomware group attempted to rally other Russian-speaking threat actors and band them together against "US interest". The plea was made in the form of an open letter published on the Groove ransomware gang blog, in Russian.
