San Francisco Trains Hit By Hackers

Hackers had an unexpected deal for San Francisco passengers on Black Friday: free journeys thanks to a ransomware attack.

Officials were forced to suspend charging on the Municipal Railway system after hackers took control of payment computers. While the problem has now been fixed, it's not known if officials paid up a reported $73,000 ransom to regain access.

The hackers manipulated the computer systems so that screens did not allow customer interaction and instead displayed a message reading "You Hacked, ALL Data Encrypted. Contact For Key (cryptom27@yandex.com)ID:681, Enter."

Attack Might Not Have Been Targeted

Staff then put up signs saying the payment system was out of service and telling customers they could ride free of charge. That could have proved hugely expensive: the system has a reported average of more than 600,000 rides a day with a standard adult charge of $2.25, meaning the lost revenue could easily have run into the millions.

It's possible the hackers simply struck lucky. When reporters contacted the listed email address, the respondent said the software which found unsecured systems and distributed the malware was running automatically rather than targeting specific potential victims. (Source: theverge.com)

The replies from the address also said that the San Francisco Municipal Transportation Agency had received a demand for 100 units of the online virtual currency Bitcoin. That's equivalent to around $73,000.

Hack Mirrors Videogame Storyline

The payment system began returning to normal on Sunday, though some drivers were still following handwritten instructions for their route assignments, rather than the usual computer printouts. (Source: sfexaminer.com)

San Francisco Municipal Transportation Agency officials have only said there is an ongoing investigation and refused to give details of exactly which data and networks was compromised or whether any payment was made to regain access.

Ironically a video game released earlier this month, Watch Dogs 2, involves a storyline where the player's character tries to hack public computer systems in San Francisco.

What's Your Opinion?

Should officials have paid the reported ransom in this case? Is it worth paying $73,000 when millions of dollars of revenue are at stake? Or is it a point of principle not to pay up and risk encouraging future attacks?