Metro Vancouver's transit system hit by Egregor ransomware

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/metro-vancouvers-transit-system-hit-by-egregor-ransomware/

The Egregor ransomware operation has breached Metro Vancouver’s transportation agency TransLink with the cyberattack causing disruptions in services and payment systems.

On December 1st, TransLink's announced that they were having issues with their information technology systems that affected phones, online services, and the ability to pay for fares using a credit card or debit card. All transit services were unaffected by the IT problems.

After restoring the payment systems, TransLink issued a statement disclosing that a ransomware attack caused the IT problems.
"We are now in a position to confirm that TransLink was the target of a ransomware attack on some of our IT infrastructure. This attack includes communications to TransLink through a printed message," TransLink disclosed in a statement.

Metro Vancouver's transit system hit by Egregor ransomware

The Egregor ransomware operation has breached Metro Vancouver's transportation agency TransLink with the cyberattack causing disruptions in services and payment systems.

www.bleepingcomputer.com

 

[silversurfer]

At the moment, most of TransLink's systems are still down after the ransomware attack — including real-time GPS data, tracking, and reporting systems — with company technicians working to restore them as soon as possible.
Customers who want to track buses are advised to use Google trip planner "for the time being," until tracking systems are back online.
"We are now in the process of gradually bringing priority systems back online as safely as possible," Murphy added.

Unfortunately we're not able to confirm this information at this time, as most of our systems remain unavailable after a cyberattack. We're recommending using Google trip planner for the time being, but that also won't be updated for Winter service changes until tomorrow. ^nv
— TransLink BC | Masks Mandatory (@TransLink) January 3, 2021​

TransLink confirms ransomware data theft, still restoring systems

Metro Vancouver's transportation agency TransLink has confirmed that the Egregor ransomware operators who breached its network at the beginning of December 2020 also accessed and potentially stole employees' banking and social security information.

www.bleepingcomputer.com

 

[Thales]

This show us the prevention is important.
Make redundant backup protected from ransomware, give limited access to most of the employees.
Delete everything and restore the system.

But most importantly Hire competent system administrator and get rid of the old one!
You are welcome!