NewsPublished 27 May 2026

LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers

Source SecurityWeek

Description

The attack was claimed by a hacktivist group, but evidence showed it used infrastructure linked to Iranian government threat actors. The post LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers appeared first on SecurityWeek .

Impact

The attack resulted in significant data exfiltration (over 1TB) and destructive wiping of hundreds of terabytes of data within LA Metro's internal systems. Operational disruptions occurred internally, requiring extensive server checks before restoration. However, critical public transportation services such as rail and bus operations were not affected. The compromise of operational technology systems used for train monitoring presents potential safety and operational risks, though no direct impact on service was reported. The incident highlights the capability of Iranian state-linked actors to conduct disruptive and espionage activities against critical infrastructure organizations.

Defensive guidance

Given the nature of the attack involving data exfiltration and destructive wiping, incident response should focus on containment, forensic analysis, and restoration from clean backups. No vendor advisory indicates that no action is required or that the issue is already mitigated.

Summary

The LA Metro cyberattack involved unauthorized access and data exfiltration by a group claiming hacktivist motives but linked through forensic evidence to Iranian state-sponsored actors. The attackers compromised hundreds of servers, accessed core virtualization and operational technology systems, and conducted destructive wiping of data. The group Ababil of Minab is likely a front for Iranian government-affiliated threat actors, with prior activity targeting multiple countries and sectors. The incident caused internal disruptions but did not impact public transportation services.

References

securityweek.com/la-metro-cyberattack-linked-to-iranian-state-sponsored-hackers/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 May 2026, 09:48 UTC

References

Community reviews