The Maryland Transit Administration (MTA) suffered a ransomware attack by the Rhysida gang, resulting in the theft of sensitive data, including passports, driver’s licenses, and contracts. While core transit services (buses, subways, light rail) remained operational, the attack disrupted real-time tracking systems and the Mobility service—a specialized transit program for disabled individuals—requiring an interim call system for recovery. The MTA confirmed data loss but refused to disclose specifics due to an ongoing investigation. The gang demanded 30 bitcoin (~$3.4M) with a 7-day deadline, releasing sample stolen data as proof. The incident follows a pattern of Rhysida targeting U.S. government entities, healthcare, and education sectors, with prior attacks on Maryland’s Prince George’s County Public Schools (exposing 100,000 records) and other state governments. Recovery efforts are underway, but some services (e.g., real-time bus tracking) remain impaired. Residents were advised to monitor for phishing, update passwords, and enable multi-factor authentication.

The Maryland Transit Administration (MTA), a division of the Maryland Department of Transportation, suffered a ransomware attack in late August 2025 attributed to the Rhysida gang. The attack disrupted critical services, including real-time bus tracking (still down at the time of reporting) and bookings for the paratransit system (MobilityLink), which serves vulnerable populations. Rhysida claimed to have exfiltrated sensitive data, posting samples such as Social Security cards, driver’s licenses, passports, and other personal documents as proof. The gang demanded 30 bitcoin (~$3.4 million) within seven days for data deletion and system restoration. The MTA confirmed data loss but declined to specify the extent or number of affected individuals, citing an ongoing investigation. If personal data was compromised, the state pledged to notify victims per legal requirements. The attack caused operational disruptions, financial risks (potential fraud for affected individuals), and reputational damage. Rhysida, a ransomware-as-a-service (RaaS) group, has a history of targeting high-profile entities, including hospitals and government agencies, with demands averaging $1.1 million. The MTA incident marks one of 59 confirmed US government ransomware attacks in 2025, highlighting systemic vulnerabilities in public transit cybersecurity.