Iranian Hackers Linked to Los Angeles Transit Cyberattack, Israeli Firm Says

A March cyberattack on the Los Angeles County Metropolitan Transportation Authority (LACMTA) has been linked to Iranian hackers, according to Israeli researchers from Gambit Security. The firm says at least 700GB of emails, backups, and internal files were stolen and later found exposed online.

Researchers traced the server to a known hacking network believed to be tied to Tehran backed operations. The group, known as Ababil, also claimed it wiped large amounts of transit system data during the attack.

LACMTA said train and bus services were not disrupted, but digital systems such as arrival screens and transit card payments were affected.

Ababil Claims Broader Global Attacks

The same group has also claimed responsibility for hacks on Tri-Rail in Florida, vehicle tracking company Vyncs, and industrial firm Unimac. Tri-Rail confirmed a breach, while other firms said they are working with the FBI.

U.S. agencies, including the FBI, say they are investigating but have not confirmed attribution. Researchers say the operation fits a pattern of Iranian state-linked cyber activity targeting infrastructure and commercial systems.