A ransomware attack targeting Pittsburgh Regional Transit (PRT) has caused disruptions to public transportation services in Pittsburgh and Allegheny County. The attack, detected on Thursday, December 19, has affected rider services and prompted an ongoing investigation.
Impact on Transit Services
PRT reported temporary rail service disruptions on December 19 but stated that transit operations are now running normally. However, key rider services remain affected, including the inability of PRT’s Customer Service Center to process Senior and Kid’s ConnectCards.
The agency, which serves nearly 40 million riders annually, operates over 700 buses and 80 light rail vehicles. As the second-largest public transit agency in Pennsylvania, the impact of the ransomware attack highlights the vulnerability of critical transportation infrastructure.
Investigation and Response
PRT is working with law enforcement and cybersecurity experts to assess the situation and determine whether data was stolen. The agency has pledged to provide updates as the investigation progresses but has not disclosed the responsible ransomware group or a timeline for full service restoration.
Local news sources reported that train delays exceeded 20 minutes on the morning the attack was detected, further underscoring the operational challenges posed by the incident.
Broader Trend of Cyberattacks on Transit Agencies
The attack on PRT is part of a growing trend of ransomware incidents targeting transportation agencies. These attacks disrupt essential services and often result in the theft of sensitive customer data.
Notable past incidents include:
- Port of Seattle (Labor Day 2024): A ransomware attack disrupted airport and seaport operations, forcing manual updates to flight information and baggage claim processes.
- New York City’s MTA and San Francisco’s BART: Both agencies experienced significant ransomware attacks over the last five years.
- London and Toronto: Transportation systems in both cities were similarly targeted, impacting millions of daily commuters.
- Regional Agencies: Public transit systems in Washington State, Massachusetts, Virginia, Kansas, and Missouri have also faced cyberattacks that disrupted buses, trains, and ferries.
Ransomware’s Ongoing Threat
Transportation agencies are increasingly appealing targets for ransomware groups due to the essential services they provide and the high stakes of operational downtime. These attacks not only disrupt transit but also jeopardize sensitive customer information, leading to widespread consequences.
The PRT incident highlights the urgent need for stronger cybersecurity measures across the transportation industry to protect infrastructure and minimize disruptions caused by cyberattacks.
Conclusion
As PRT continues its investigation, the incident serves as another reminder of the escalating risks posed by ransomware gangs targeting public transit systems. Enhancing cybersecurity resilience remains a critical priority for transportation agencies worldwide.

