Civic News
Cybersecurity / Transportation

What we know (and don’t know) about this month’s malware attack on SEPTA

The transit authority doesn't know if specific data or servers were targeted.

A SEPTA train chugs away from Overbrook Station. (Video by YouTube user Jarrett Stewart, used under a Creative Commons license)

Earlier this month, SEPTA, Philly’s public transportation network, experienced a malware attack that shut down real-time data for riders, access to internal servers and email for SEPTA employees.

Riders and employees first started experiencing problems on Monday, Aug. 10, The Philadelphia Inquirer reported, and experienced problems for at least two weeks. The malware (aka malicious software) attack also caused SEPTA to shut down access to payroll and remote timekeeping, and SEPTA’s headquarters at 12th and Market streets didn’t have internet as of Monday.

Most noticeably felt by riders was the lack of real-time data usually available in SEPTA mobile app, or on time boards at stations. It’s a function only rolled out by the transit authority in 2016, when SEPTA began installing cellular modems on every vehicle to track their location and status.

And if you were wondering, yes — Is SEPTA Fucked?‘s Doug Muth told that his site was affected, too, as the API that allows for its automatic updates was down.

SEPTA Chief Press Officer Andrew Busch told that the transit authority shut down the real-time data, email and other systems on Aug. 10 to mitigate the impact of the attack. He said that his team does not yet know the specific technical details of the malware attack, or “if specific data or servers were targeted,” but the FBI has gotten involved in the investigation, as have forensic and other outside experts.

“We are taking a methodical approach to this to ensure that when systems come back, they are protected from malware attacks,” he said.

An attack like this is new territory to the transportation authority, Busch said. It’s never seen a malware attack at this scale, but last year, there was an unrelated hack of SEPTA’s online store, which sold SEPTA-related merchandise. The incident lead to the permanent shutdown of the store.

Although the attack shut down much of SEPTA internal operations and has prevented riders from getting real-time data, Busch emphasized that the SEPTA Key system was unaffected, as it’s on a separate, air-gapped server that is operated by a third party.

“There is no impact to customer information or accounts on the SEPTA Key system,” he said.

This malware attack is another strain on the transit authority, which was already feeling the side effects of low ridership during the coronavirus pandemic and new rules surrounding social distancing and mask wearing. At least seven SEPTA employees have died because of the virus, and more than 300 employees have been recorded as contracting it, the Inquirer reported.

The attack is one of the more public and widespread cyberattacks to a City operation since last summer, when the Philadelphia Courts website detected a virus and shut down in response. It did so as a preventative measure after a virus was detected on multiple computers in the First Judicial District, and stayed down for at least a month, prompting some workarounds like checking into jury duty on Twitter and a noticeable disruption to the real estate market.

Riders saw a return of the “next-to-arrive” real-time data Monday afternoon, but there’s no definitive timeline for when all SEPTA operations will be back and fully functioning. The authority will only do so when it’s assured it’s 100% safe, Busch said.

Companies: SEPTA

Join the conversation!

Find news, events, jobs and people who share your interests on's open community Slack


Philly daily roundup: A better coffee supply chain; Philly Tech Week returns; Apply to Pennovation Accelerator

Philly daily roundup: Startups want office culture; New Venture Lab cohort; Penn Med's new AI leader

Will the life sciences dethrone software as the king of technology?

A biotech hub is rising at Philadelphia’s shuttered Hahnemann Hospital campus

Technically Media