LA Metro (LACMTA) Iran-linked breach (2026)

In mid-March 2026, the Los Angeles County Metropolitan Transportation Authority (LA Metro) — the public agency that operates rail and bus service across Los Angeles County — was hit by an intrusion that forced parts of its network offline and took weeks to fully recover. A pro-Iran persona calling itself "Ababil of Minab" claimed responsibility, asserting it had stolen and then deleted data from the agency's systems. Israeli researchers have since tied the operation to Iran's Ministry of Intelligence and Security.

What happened

The breach disrupted several customer-facing systems, including real-time arrival information displays and TAP card reloading, although trains and buses continued operating normally throughout. Researchers later reported that the attackers reached operational displays inside the agency's environment, and that at least 700 GB of emails, backups, and internal files were exfiltrated — material that was subsequently found inadvertently exposed online.

In late May and early June 2026, the Israeli cybersecurity firm Gambit published forensic analysis concluding that "Ababil of Minab" was unlikely to be a genuine standalone hacktivist crew. Instead, Gambit said infrastructure and tradecraft tied the intrusion to Black Shadow, a group the Israel National Cyber Directorate has attributed to Iran's Ministry of Intelligence and Security (MOIS). Gambit linked the same actor to a broader campaign against transit and other organizations in the United States and the Middle East.

Why it matters

The incident underscores how pro-Iran operators have increasingly targeted U.S. critical infrastructure, blending hacktivist-style claims with state-directed activity. Los Angeles is a host city for the 2026 FIFA World Cup, raising the stakes for the resilience of its transit network. While trains and buses kept moving, the disruption to passenger-information and fare systems — combined with the exfiltration of hundreds of gigabytes of internal data — illustrates how a transit agency's back-office and customer-facing IT can be degraded without touching the trains themselves.