Ransomware attack led to 3 days of transit payment problems, TransLink says

TransLink says customers can return to using credit cards and debit cards at ticketvending machines and fare gates after threedays of being unable to do so becauseofa ransomware attack on the Metro Vancouver transit authority.

CEO of Translink Kevin Desmond issued a statement Thursday afternoon to apologize for the inconvenience and provide more information about the mysteriouscyberattack.

"We are now in a position to confirm that TransLink was the target of a ransomware attack on some of our IT infrastructure. This attack included communications to TransLink through a printed message," said Desmond.

TransLink disabled several of its systems "out of an abundance of caution" on Tuesday after strange network activity affected some systems that morning. The transit authority would not release furtherinformation about the nature of the network activity, citing an ongoing police investigation.

At the time, aspokesperson did not answer a question about whether the activity involved customers' personal information.

Ransomware is a type of malicious software that disables part of a computer system or access to data until a ransom is paid.

However, TransLinksaid Thursday thatupon detection, the transit authority took immediate steps toshut down key ITsystems to reduce the impact to its infrastructureand operations.

TransLinksaid a forensic investigation is underway to determinehow the incident occurred and what information was affected.

The transit authority is trying to reassure customers and saidit does not store fare payment data and uses a secure third party to process payments for fare transactions.

Metro Vancouver Transit Police confirmed in an email Wednesdayit is investigating "in partnership with local and national cyber crime experts."

For days, TransLink passengers were able to use cash at vending machines and staff wereon site to help customershaving problems buying fares. The authority had warned stored value couldtake longer than usual to load onto a Compass Card but those systems are now back to normal.

TransLink's Trip Planner tool hadalso been disabled.

As of Thursday evening, TransLink said it was working to resume normal operations as quickly as possible.

The issue has also affectedemployees' pay.

Coast Mountain Bus Company, which handles bus service in the region on behalf of TransLink, sent a memo to workers on Thursday sayingthey would be paid in the form of an advanceon Friday, but aspects of some employees' paychequeslike payment for overtime and a reviewable pay stub would be missing.

Any overpayments will be recovered on future paystubs, the memo said, while"adjustments will occur" at a later date if someone is underpaid.