San Francisco public transit system hit in ransomware attack

Ouch...that must hurt...but most of all it is surprising that this could be allowed to happen...obviously someone clicked on an unsafe attachment, etc.
 
Until people get more savvy about what ransomware is and how it propagates then I suppose that this sort of thing will continue to make headlines...unfortuantely. :(

Backups meant SFMTA didn't have to pay 100-Bitcoin ransom demanded by the attacker.

 
                    

 
Sean Gallagher - 11/29/2016
 
The attacker who infected servers and desktop computers at the San Francisco Metropolitan Transit Agency (SFMTA) with ransomware on November 25 apparently gained access to the agency's network by way of a known vulnerability in an Oracle WebLogic server. That vulnerability is similar to the one used to hack a Maryland hospital network's systems in April and infect multiple hospitals with crypto-ransomware. And evidence suggests that SFMTA wasn't specifically targeted by the attackers; the agency just came up as a target of opportunity through a vulnerability scan.
 In an e-mail to Ars, SFMTA spokesperson Paul Rose said that on November 25, "we became aware of a potential security issue with our computer systems, including e-mail." The ransomware "encrypted some systems mainly affecting computer workstations," he said, "as well as access to various systems. However, the SFMTA network was not breached from the outside, nor did hackers gain entry through our firewalls. Muni operations and safety were not affected. Our customer payment systems were not hacked. Also, despite media reports, no data was accessed from any of our servers."
 
Full Article