Auckland Transport authority says possible ransomware attack downed online ticketing system

The Auckland Transport authority in New Zealand suffered a significant cyber attack that caused widespread outage and disrupted day-to-day operations.

In a recent notice on its website, Auckland Transport authority (AT) said that it was a victim of a cyber security incident that affected the HOP system, its integrated ticketing and fares system. The incident prevented passengers from using their HOP cards to avail public transport services.

“We are currently experiencing issues with some AT HOP services. During this period, you can continue to catch buses, trains and ferries. You should still tag on and off when travelling,” Auckland Transport authority said.

“The issue is impacting top-ups and other HOP card services. Our staff and operators will ensure you are still able to travel, even if your HOP card is unable to be topped-up,” it added.

AT believes that the cyber attack is an isolated incident and is limited to the HOP service systems. The company found no evidence of any personal or financial information being compromised or stolen.

AT said the following services were affected by the cyber security:

• Online top ups, as well as other AT HOP services using MyAT HOP on the AT website
• Existing auto top ups will still work, but there will be a delay in the payment being processed.
• Ticket and top up machines are only accepting cash payments. Transactions using Eftpos/credit cards are unavailable. Some machines may not be working.
• AT customer service centres will have limited functionality and most are only able to accept cash payments.
• AT HOP retailers are unable to top up HOP cards or process other AT HOP services like loading concessions.

In a statement shared with local media agencies, an AT spokesperson said, “Indications are that this is a ransomware attack, however, investigations are ongoing. Our customers across Tāmaki Makaurau can still catch buses, trains and ferries – our staff and operators are aware of the issue and will be letting people board even if they have been unable to top up their AT Hop card.”

“We have activated our security protocols and are working with our expert partners to resolve the issue as quickly as possible, however we anticipate it may take until early next week to fully restore these services,” he added.

The authority issued a detailed update about the impact of the cyber security incident on Wednesday morning, stating that though AT HOP retailers remain unavailable for top ups and other AT HOP services, most AT customer service centres, including Britomart and Downtown Ferry Terminal, are now able to process top-ups.

The authority said it expects to restore online top ups and other AT HOP services using the MyAT HOP feature on its website, but live bus tracking for some buses is currently unavailable.

"AT takes cyber security very seriously. We activated our security protocols as soon as we became aware of the incident last week and are working with our expert partners to minimise any future risk to our systems. Investigations into the cyber incident are still ongoing, and at this stage AT still believes customer data, including financial data, has not been compromised," the authority added.