Iran-Linked Cyberattack Behind Los Angeles Transit System Breach Recovery Delays

Security researchers say the cyberattack that disrupted the Los Angeles County Metropolitan Transportation Authority earlier this year was likely carried out by hackers linked to the Iranian government.

Israeli cybersecurity firm Gambit Security said in a report released Tuesday that the group behind the March breach, known as “Ababil of Minab,” is connected to Iran’s Ministry of Intelligence and State Security (MOIS). Reuters first reported the findings.

The group had previously claimed responsibility for stealing and deleting data from LACMTA systems. Its name references a past U.S. airstrike on a school in the Iranian city of Minab that reportedly killed more than 175 people.

According to Gambit, the hackers are not an independent hacktivist organisation as they claim to be. The company said forensic evidence linked the group to previous Iran-linked cyber campaigns and activity already attributed to MOIS by the Israeli National Cyber Directorate.

The report also noted similarities between this operation and attacks targeting companies and organisations in Israel, Saudi Arabia, and Turkey.

If Gambit’s findings are accurate, Ababil of Minab would become the latest example of a cyber group allegedly operating on behalf of the Iranian government. Earlier this year, another group known as Handala was accused of attacking a U.S. medical technology company, Stryker, wiping thousands of company systems and employee devices.

Following that breach, the Federal Bureau of Investigation seized websites connected to Handala, while the United States Department of Justice publicly accused Iran of supporting the group’s cyber operations.

Cybersecurity officials have warned that Iranian-linked hacking activity has increased following escalating tensions between Iran, the United States, and Israel earlier this year. In April, several U.S. agencies issued warnings that Iranian hackers were increasingly targeting American critical infrastructure.

The Los Angeles transit breach adds to growing concerns about cyberattacks aimed at transportation systems and other essential public services.