Cyber Incident Victim: Bay Area Rapid Transit Police Department
Date:
Jan 2023
Location:
United States of America
Summary
A ransomware group breached the Bay Area Rapid Transit Police Department, leaking over 120,000 sensitive files containing unredacted child abuse reports with minors' personal details, mental health evaluation records, contractor driver's license information, criminal suspect names in police reports, and hiring documents. The attackers publicly released the data after the agency refused payment demands, though transit operations remained unaffected. This incident exemplifies growing cyber extortion threats against public sector entities, where compromised law enforcement data risks investigations and personal safety while exposing highly confidential records. The leaked materials included identifiable information about vulnerable individuals and personnel, highlighting severe privacy implications from such breaches.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early January 2023, criminal hackers leaked over 120,000 sensitive files from the Bay Area Rapid Transit (BART) Police Department, exposing highly confidential records. The compromised data included at least six unredacted child abuse reports containing minors' names, birthdates, and explicit descriptions of alleged abuse incidents. Additional leaked materials featured mental health evaluation forms used by officers to recommend psychiatric assessments, driver's license numbers of contractors who worked on BART projects, police reports identifying crime suspects, and hiring documentation for prospective officers. While BART's chief communications officer Alicia Trost confirmed an investigation into the breach, the exact intrusion timeline remained unclear. The department stated that transit operations weren't disrupted by the cyberattack. Cybersecurity analyst Brett Callow noted the public data release indicated BART refused to pay the ransomware demand, though officials declined to confirm negotiation details.
The incident exemplified escalating ransomware threats against U.S. public sector entities, with Emsisoft reporting over 100 successful attacks against local government networks in 2022. The breach exposed vulnerabilities in safeguarding sensitive law enforcement data, potentially compromising ongoing investigations and endangering both officers and civilians referenced in leaked documents. Historical parallels included a 2021 attack on Washington D.C.'s Metropolitan Police Department, where another hacker group leaked profiles of 22 officers after ransom demands were rejected. While such police data leaks remained relatively rare, the Treasury Department estimated ransomware costs reached $886 million across U.S. organizations in 2021. The BART breach underscored systemic security challenges facing public agencies, with Callow emphasizing insufficient progress in protecting critical infrastructure from cyber extortion.