On December 23, 2024, Pittsburgh Regional Transit experienced a ransomware attack that caused considerable disruptions to its transportation services. The incident was promptly addressed with an investigation, law enforcement notification, and the expertise of cybersecurity professionals. Although there was a temporary suspension of rail services on Thursday morning, operations have since returned to normal. Nonetheless, certain rider services like the PRT Customer Service Center remained affected with an inability to manage Senior and Kid's ConnectCards. The extent of data compromise, if any, remains undetermined, and the identity of the cyber attackers or ransomware gang responsible for the incident has not been disclosed.

Pittsburgh Regional Transit (PRT) suffered a ransomware attack on December 19, disrupting critical transit operations. The attack caused temporary outages in the city’s T rail system, leading to 20-minute delays and forcing several systems offline. While rail services resumed normal operations by the following week, other key functions—such as the Customer Service Center and processing of senior/child ConnectCards—remained impaired. PRT activated its Cyber Incident Response Team, engaged third-party forensics experts, and notified law enforcement, but the extent of data compromise (if any) and the attacker’s identity remain undisclosed.The incident highlights the vulnerability of public transit agencies, which are frequent targets due to their sensitive customer data and potential to cause large-scale operational disruptions. Similar attacks have previously crippled transit systems, including the Port of Seattle (2023) and SEPTA (2020), where real-time transit information was knocked offline for weeks. PRT emphasized its commitment to security but withheld specifics, citing the ongoing investigation’s sensitivity. The attack underscores the growing threat of ransomware against critical infrastructure, risking public safety, financial losses, and reputational damage.