Cyber Incident Victim: Davincys
Date:
Aug 2022
Location:
Canada
Summary
A cyberattack targeting Davincys, an IT services provider for multiple public transit agencies, disrupted adapted transport services across several regions including Sherbrooke, Lévis, Trois-Rivières, Saguenay, and Outaouais. The incident forced suspension of online booking systems for specialized transit, requiring users to make reservations by phone and prioritize essential travel such as medical appointments or work. While regular urban transit services remained operational, the provider and affected organizations implemented immediate mitigation measures with cybersecurity experts to restore functionality. The attack exclusively impacted adapted transportation systems, with no reported compromise of broader public transit infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 6 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On August 10, 2022, the Société de transport de Sherbrooke (STS) publicly disclosed that Davincys, one of its IT service providers, had suffered a cyberattack disrupting Sherbrooke’s adapted transport services. The attack rendered online booking systems inoperable, forcing passengers requiring wheelchair-accessible or specialized transportation to make reservations by phone instead. STS confirmed the attack exclusively impacted adapted transport operations, with regular urban bus services remaining fully functional. Immediate operational restrictions were implemented, limiting adapted transport to essential trips only—defined as medical appointments, work commutes, and emergencies—until systems could be restored. STS emphasized rapid response efforts were underway with Davincys and cybersecurity experts to contain the incident and restore services, though no timeline for resolution was provided.
The cyberattack’s impact extended beyond Sherbrooke, affecting Davincys’ other municipal transportation clients in Lévis, Trois-Rivières, Saguenay, and Outaouais, all of which experienced similar service interruptions for adapted transport. STS instructed new customers needing La vermeilleuse smart cards or card reprints to contact customer service via a designated phone extension. While the organization assured the public that immediate containment measures had been deployed to limit operational damage, the prolonged outage necessitated sustained manual booking processes. No data breach or ransomware specifics were disclosed, with public communications focusing solely on service availability and contingency procedures. Recovery efforts remained ongoing at the time of reporting, with no additional technical details about the attack’s origin or methodology revealed.