MTA Reveals Three of its Technological Systems were Cyberattacked in April

     Cyberattackers, who are believed to have links to the Chinese government, targeted the Metropolitan Transportation Authority (MTA) last month in an intrusion that did harm any customers, employees, or customer information, confirmed MTA officials confirmed, who said that no one in the world was aware of the attack at the time it took place.

     On the evening of April 20, federal security agencies issued a joint alert that three of the MTA’s 18 technological systems had been impacted by the cyberattack, although the nature and source of the attack are still unclear.

      By the next day, the Cybersecurity and Infrastructure Security Agency (CISA) provided the MTA with recommendations to fix the three systems, to which the agency immediately applied CISA’s strategic patches. 

      Also on April 21, the MTA immediately hired IBM and Mandiant, which is owned by leading cyber firm FireEye, to provide a forensic audit, which found no evidence of comprised accounts, breached employee information, lost data, or of any other vital changes, according to MTA officials.

     Although the cyberattack did not in any way affect employees or customers, the MTA ensured, as a precautionary measure, that 5% of MTA employees and contractors, or 3,700 people, change their passwords.

      As one of the additional layers of protection and greater security the MTA added, the agency also moved data, or “migrated it” off its virtual private network (VPN) to other VPNs.

      "The MTA quickly and aggressively responded to this attack, bringing on Mandiant, a leading cybersecurity firm, whose forensic audit found no evidence operational systems were impacted, no employee or customer information breached, no data loss and no changes to our vital systems,” said Rafail Portnoy, the MTA’s chief technology officer. “Importantly, the MTA’s existing multi-layered security systems worked as designed, preventing the spread of the attack and we continue to strengthen these comprehensive systems and remain vigilant as cyber-attacks are a growing global threat.”