San Francisco Subway Responds to Ransomware with Free Rides

As the San Francisco subway system worked to rid itself of ransomware, customers enjoyed free rides over the holiday weekend.

To keep operating, the San Francisco Municipal Transportation Agency turned off ticket machines and gates at subway stations Nov. 25 through Sunday morning. “This action was to minimize any potential risk or inconvenience to Muni customers,” according to an agency statement.

SFMTA reached out to the Homeland Security Department and the FBI Friday when malware encrypted some of its systems, including about 900 office computers, email and payroll systems. The agency said the attack didn’t affect train and bus operations, nor did it impact customer payments data.

Compromised computer screens read, “You hacked” and asked for 100 bitcoins, or about $73,000, according to SFGATE.

“The SFMTA has never considered paying the ransom. We have an information technology team in place that can restore our systems, and that is what they are doing,” SFMTA said.

The agency expects finish restoring systems from its backups in the next couple of days.