Iranian hackers responsible for Los Angeles transit system breach in March, Israeli researchers say

Iranian hackers were responsible for a disruptive computer breach in March that forced Los Angeles’ transit system to shut down parts of its network, Israeli researchers say.

The saboteurs stole at least 700 gigabytes of emails, backups and other files from the Los Angeles County Metropolitan Transportation Authority (LACMTA), according to Gambit Security, a Tel Aviv-based cybersecurity firm that says it discovered the misappropriated data after it was inadvertently exposed online.

The company says a digital trail of evidence tied the server where the data was discovered to a previously known hacking operation that Israeli officials and researchers attributed to Tehran.

Iran’s mission to the United Nations does not return messages seeking comment. Israel’s National Cyber Directorate does not return messages.

The Los Angeles transit authority didn’t respond to questions about the findings. In a statement shared last month, its officials said they were working with law enforcement and cyber specialists as they brought their systems back online. “Attribution is part of the investigation and we will not speculate,” the statement said.

Digital security specialists have suspected an Iranian hand in the operation against the LACMTA ever since responsibility was claimed by an obscure pro-Iran outfit calling itself Ababil of Minab. The group’s name refers to the bombing of a girls’ school in the Iranian city of Minab that officials there say killed more than 175 children and teachers, and its rhetoric and modus operandi are characteristic of self-styled vigilante hacker groups that US and Israeli researchers allege are cut-outs for Iranian spies.