Cyber-attacks on public transport offices on the rise

Public transportation offices are witnessing a surge in social engineering cyberattacks, where intruders attempt to psychologically manipulate employees and contractors to gain confidential information. During a roundtable at the annual Transportation Research Board meeting on January 8, experts shared examples of these sophisticated attacks.

The Port Authority of New York and New Jersey has been particularly susceptible, with cybercriminals exploiting the “human fallibilities and vulnerabilities” of its employees, according to Josh DeFlorio, Chief of Resilience and Sustainability at the Port Authority.

In social engineering cyberattacks, digital criminals leverage their social skills to engage with specific organizational staff, aiming to obtain confidential information or access their computer systems. Jennifer DeBruhl from the Department of Rail and Public Transportation in Virginia recounted a successful attack that led to a statewide system outage lasting six months.

Cordell Schachter, Chief Information Officer of the United States Department of Transportation (USDOT), emphasized the importance of preventive measures, such as multi-factor authentication and system segmentation. He recommended a cybersecurity self-assessment and contacting the FBI or the Cybersecurity and Infrastructure Security Agency (CISA) in case of an attack. “Everyone should undergo a cybersecurity self-assessment to help us understand our current risks and report our plans to remedy them,” stated Schachter.