Read that a handful of transit agencies were hit by ransomware last year and it is tempting to think your fleet is fine. The headline number is almost certainly low: for every confirmed transit agency ransomware attack, several more go unconfirmed, unreported, or quietly denied. To keep your records working even when IT is down, you can book a quick demo.
The Real Number of Transit Ransomware Attacks Is Higher Than Reported
Confirmed attacks are only the visible tip. One ransomware group alone made far more unconfirmed claims than confirmed ones in a single year, and agencies often deny or delay disclosure. The attacks you read about are a fraction of the ones that happen.
Confirmed vs unconfirmed: one ransomware group, one year
Illustrative of a documented 2025 pattern: a single ransomware group logged eight confirmed attacks against government entities alongside dozens of unconfirmed claims. The visible count understates the real exposure.
Transit Agencies Are a Repeat Target
This is not a one-off risk. Public transportation keeps showing up on the list of ransomware victims, year after year, across agencies large and small. The names below are only the confirmed, publicly acknowledged incidents, which by the logic above means the full picture is worse.
San Francisco Muni (SFMTA)
Ransomware hit ticketing over Thanksgiving; the agency offered free rides and faced an estimated six-figure daily fare loss.
Kansas City Area Transportation Authority
A ransomware group hit the agency and demanded a reported 2 million dollars.
Pittsburgh Regional Transit
An attack disrupted transit services and internal systems during the holiday travel season.
Maryland Transit Administration
The Rhysida group breached MTA, disrupted the MobilityLink paratransit service, and demanded a reported 3.4 million dollars.
Attackers also go after the services riders can least afford to lose: paratransit booking systems for disabled passengers have been knocked offline in multiple states. For a deeper look at the federal reporting duties these attacks now trigger, see the BusCMMS guide to CIRCIA compliance for transit agencies.
Four Reasons the Reported Number Undershoots
The gap between what happens and what gets counted is not an accident. Several forces push the public number down, which is exactly why a transit ransomware tally should be read as a floor, not a ceiling.
Denials and disputes
Agencies sometimes dispute or decline to confirm a claim, so a real intrusion never becomes a confirmed statistic.
Unconfirmed leak-site claims
Gangs list far more victims than are ever verified, leaving most claims in a gray zone no tally captures.
Quiet recovery
Agencies that restore from backups without paying may never publicize the incident at all.
Reporting lag
Investigations take months, so this year's true count is not knowable until well after the year ends.
Put together, these mean the confirmed count you can cite today is the smallest honest version of the problem. Planning around operational continuity, so a bus fleet keeps running when systems go dark, is the practical response, and you can start setting that up free.
What Makes a Bus Agency an Easy Mark
Attackers pick transit agencies for concrete reasons, and most of them are fixable operational habits rather than exotic technical gaps. Knowing the pattern is how you decide where to harden first.
Swipe sideways to see all columns.
The through-line is dependence: the more your daily operation relies on one fragile system, the more an outage hurts. Transportation-sector breaches have run into the millions in average cost, so the resilience question is a budget question too. A platform demo is a practical place to see how records stay usable during an outage.
A Transit Resilience Checklist
You will not stop every attack, but you can make one survivable. CRITICAL items keep the fleet moving through an outage; PLAN items reduce the odds and the fallout.
- CRITICALKeep an offline fallback for operations. Maintenance, inspection, and compliance records you can reach when IT is down.A fleet that can run on backed-up records is far harder to extort.
- CRITICALBack up critical records regularly. Tested, separate backups so a recovery does not depend on the attacker.Agencies that restore from backups are the ones that avoid paying.
- CRITICALKnow your reporting obligations. Understand the federal and state timelines a breach now triggers before one happens.A reporting plan written during an incident is already too late.
- PLANRetire or isolate legacy systems. Segment the oldest, least-patchable tools away from core operations.Legacy software is the opening attackers lean on most.
- PLANConsolidate fragmented tools. Fewer disconnected systems mean faster detection and cleaner recovery.Fragmented IT slows both catching and recovering from an attack.
- PLANPractice the manual fallback. Make sure drivers and shop staff can operate on paper or offline for a day.The agencies that coped best had a manual plan ready to go.
A maintenance platform is one piece of this: it keeps the records that prove a bus is safe and compliant available even when other systems are down. You can see that in a demo.
Continuity, Not a Security Promise
Let us be clear about what a maintenance platform does and does not do. BusCMMS will not stop a ransomware attack; that is the job of your IT and security team. What it does is keep the operational backbone of a bus fleet, the inspection, maintenance, and compliance records, in one purpose-built, backed-up place, so a system outage does not also mean your buses cannot prove they are safe to run.
Records that persist
Inspection and maintenance history kept in one place, backed up, not scattered across fragile tools.
Audit-ready at any time
DVIR and compliance records stay accessible, so an outage does not create a compliance gap.
Fewer fragmented systems
Consolidating maintenance, fuel, and compliance reduces the fragmented tools attackers exploit.
Keep the fleet moving
A fleet that can operate on backed-up records is harder to pressure into paying.
"When our county had its incident, the agencies that struggled were the ones whose whole operation lived in one system that went dark. We came out of it deciding that anything keeping our buses legal to run had to be backed up and reachable no matter what IT was doing."
Operations director, regional transit agency
What to Remember About Transit Ransomware
- 1The reported number is a floor. Denials, unconfirmed claims, and quiet recoveries hide most of the real total.
- 2Transit is a repeat target. Legacy systems, rider data, and low downtime tolerance make agencies attractive and likely to pay.
- 3Continuity beats panic. You cannot stop every attack, but backed-up, reachable records keep the fleet running.
- 4Know your reporting duties. Federal and state breach-reporting timelines now apply; have the plan before you need it.
The honest answer to how many transit agencies get hit is: more than the count you can see. Treat the public number as the visible tip, plan for the outage rather than only the attack, and make sure the records that keep your buses safe and legal survive whatever happens to the rest of your systems. You can walk through that in a demo.
Transit Ransomware FAQs
How many transit agencies have been hit by ransomware?
More than the public count shows. Confirmed incidents span agencies like San Francisco Muni, Kansas City, Pittsburgh Regional Transit, and Maryland MTA, but denials, unconfirmed claims, and quiet recoveries mean the true number is higher.
Why is the reported number of attacks too low?
Agencies sometimes dispute claims, gangs list far more victims than are ever verified, some agencies recover quietly without disclosing, and investigations lag by months. Each force pushes the public tally below reality.
Why do attackers target public transit?
Transit agencies often run legacy systems, hold sensitive rider and payment data, and cannot tolerate long downtime, which makes them easier to breach and more likely to pay a ransom to restore service fast.
Can a maintenance platform protect against ransomware?
Not directly; security is your IT team's job. What a maintenance platform does is keep inspection and compliance records backed up and reachable, so an outage does not stop your fleet from proving it is safe to run.
What should transit agencies do first?
Back up critical records separately, keep an offline fallback for core operations, understand your breach-reporting duties, and practice a manual day. Resilience planning is what turns an attack into a disruption instead of a shutdown.
