The Iranian operator group Ababil of Minab, which has claimed destructive intrusions against targets in the US, Israel, Saudi Arabia, and Turkey, left their staging server wide open. Hunt.io researchers discovered this server containing approximately 5 GB of data, including upload tooling, bash history, and folders named after each victim. Among the exposed data were over a gigabyte of LA Metro SQL backups and SCADA configuration files. This exposure effectively named every LA Metro breach victim that had been withheld in prior public reports. The breach was confirmed by LA Metro in April 2026. The staging server leak provides new insight into the scope of the campaign and victimology.

The exposure of the staging server publicly revealed sensitive data related to multiple victims of the Ababil of Minab campaign, including detailed SQL backups and SCADA configurations for LA Metro. This data leak increases the risk of further exploitation or secondary attacks against these victims. The disclosure also reveals attacker operational details and tooling, which may aid defenders in threat hunting and attribution. The breach confirms the compromise of critical infrastructure and sensitive operational data.

No official patch or remediation is applicable as this is a breach caused by attacker operational security failure. Organizations potentially impacted should review the exposed data to assess risk and strengthen their defenses accordingly. Monitoring for related attacker activity and applying threat intelligence from Hunt.io and similar sources is recommended. Since this is a data exposure incident, mitigation focuses on incident response and containment rather than patching.