Montréal's STM hit by ransomware attack

[EdwinG]

I guess the title says it all. Montréal's Société de Transport de Montréal (STM), the public transportation authority for the Island of Montréal, has been hit by a ransomware attack. Not a lot of details are known, because it occurred less than 48 hours ago and the authorities are involved.

This one has brought down their websites and phone systems. We know most of their customer-facing services, bus and métro service, are not affected. It does affect paratransit.

My simplistic take: It's not because you have a multi-million dollar budget that you're invulnerable to attacks. You should patch those servers as early as possible. Given that the (unnamed, but reasonably expected Royal Canadian Mounted Police [federal police service]) authorities are involved, we won't know for a couple of weeks to allow them to do their investigation.

Sources:

• Bleeping Computer: Montreal's STM public transport system hit by ransomware attack
• CTV News: STM targeted by ransomware attack, online platforms down
• Société de Transport de Montréal: Major computer failure in progress

 

[iefbr14]

I guess the title says it all. Montréal's Société de Transport de Montréal (STM), the public transportation authority for the Island of Montréal, has been hit by a ransomware attack. Not a lot of details are known, because it occurred less than 48 hours ago and the authorities are involved.

I'm so not surprised by that information. From a client side perspective, their IT department is really not impressive. The classic story of a public services organisation that is too often far behind the standard trends in security and innovation. Sad story for its customers who have to cope with the consequences and still pay full price for a frequently failing service.

 

[EdwinG]

We don’t know a whole lot about STM’s internal infrastructure to conclude what their security practices were at the time of the attack.

I doubt, but it is within the realm of the possible, that they have all their devices patched within the month of a critical vulnerability being corrected.

What I can say is that the STM is not responsible for fares. They only collect them and transfer the money to another agency, which will redistribute the funds prorata to the services offered. It’s a very messy politicized system that I don’t want to get into.