The Maryland Transit Administration (MTA) in the US state of Maryland suffered a **cyber incident** due to **unauthorized access to specific systems**, causing operational disruptions. While core transit services (e.g., Local Bus, Metro Subway, Light Rail) remain functional, critical disruptions include: - **Mobility Paratransit Services** (new bookings and rescheduling halted), - **real-time updates and call center support** (unavailable), - **Baltimore Metro Subway elevators** (shut down due to inoperable emergency phones). The incident forced collaboration with the **Maryland Department of Information Technology (DoIT)**, third-party cybersecurity experts, and law enforcement. The **Statewide Emergency Operations Center (SEOC)** was activated to coordinate response efforts. Customers with urgent medical needs were redirected to healthcare providers or emergency services, highlighting potential risks to vulnerable populations. The attack’s scope suggests targeted disruption of public infrastructure, though no data breach or ransomware demands were reported.
Source: https://www.infosecurity-magazine.com/news/us-maryland-cyber-incident/
TPRM report: https://www.rankiteo.com/company/mtamaryland
"id": "mta853090225",
"linkid": "mtamaryland",
"type": "Cyber Attack",
"date": "8/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'customers_affected': 'Users of Mobility Paratransit '
'Services, real-time updates, '
'call center support, and '
'Baltimore Metro Subway '
'elevators',
'industry': 'Transportation',
'location': 'Maryland, USA',
'name': 'Maryland Transit Administration (MTA)',
'type': 'Government Agency'},
{'industry': 'Information Technology',
'location': 'Maryland, USA',
'name': 'Maryland Department of Information Technology '
'(DoIT)',
'type': 'Government Agency'},
{'industry': 'Emergency Management',
'location': 'Maryland, USA',
'name': 'Maryland Department of Emergency Management '
'(MDEM)',
'type': 'Government Agency'}],
'customer_advisories': 'Eligible riders advised to use Call-A-Ride; customers '
'with urgent medical needs directed to healthcare '
'providers or emergency services.',
'date_detected': '2023-08-24',
'date_publicly_disclosed': '2023-08-24',
'description': 'Users of some transport services in the US state of Maryland '
'may experience disruptions as the Maryland Transit '
'Administration (MTA) deals with a cyber incident. The MTA '
'confirmed unauthorized access to specific systems on August '
'24. While most core transit services (Local Bus, Metro '
'Subway, Light Rail, MARC, Mobility, Call-A-Ride, and Commuter '
'Bus) are operational, some services—including Mobility '
'Paratransit trip bookings, real-time updates, call center '
'support, and Baltimore Metro Subway elevators—are disrupted. '
'The MTA is investigating with support from the Maryland '
'Department of Information Technology (DoIT), third-party '
'cybersecurity experts, and law enforcement. The Maryland '
'Department of Emergency Management (MDEM) has activated the '
'Statewide Emergency Operations Center (SEOC) to coordinate '
'the response.',
'impact': {'downtime': {'Baltimore Metro Subway elevators': 'Out of service '
'(emergency '
'phones '
'unavailable)',
'Call center support': 'Disrupted',
'Mobility Paratransit Services': 'Temporarily '
'unavailable (new '
'bookings/rescheduling)',
'Real-time updates': 'Disrupted'},
'operational_impact': 'Partial disruption of transit services; '
'core services (Local Bus, Metro Subway, '
'Light Rail, MARC, Mobility, Call-A-Ride, '
'Commuter Bus) remain operational.',
'systems_affected': ['Mobility Paratransit trip '
'booking/rescheduling system',
'Real-time updates system',
'Call center support system',
'Baltimore Metro Subway elevator emergency '
'phones']},
'investigation_status': 'Ongoing (in collaboration with DoIT, third-party '
'cybersecurity experts, and law enforcement)',
'references': [{'date_accessed': '2023-08-24',
'source': 'MTA Public Statement'},
{'date_accessed': '2023-08-24', 'source': 'MTA Social Media'},
{'source': 'Shutterstock (Photo Credit)'}],
'response': {'communication_strategy': {'customer_advisories': 'Eligible '
'riders '
'advised to '
'use '
'Call-A-Ride; '
'customers '
'with urgent '
'medical needs '
'directed to '
'healthcare '
'providers/emergency '
'services',
'public_statement': 'Issued on August '
'24 via MTA and '
'social media'},
'incident_response_plan_activated': True,
'law_enforcement_notified': True,
'remediation_measures': 'Under investigation and collaboration '
'with DoIT, third-party cybersecurity '
'experts, and law enforcement',
'third_party_assistance': True},
'stakeholder_advisories': 'Maryland Department of Emergency Management (MDEM) '
'activated the Statewide Emergency Operations '
'Center (SEOC) for coordination.',
'title': 'Cyber Incident Affecting Maryland Transit Administration (MTA) '
'Services',
'type': 'Cyber Incident (Unauthorized Access)'}