Oahu Transit Services Inc.

Oahu Transit Services, also knownas Oahu Transit Services Inc., operates the public transportation system for the island of Oahu in the State of Hawaii. It runs TheBus fixed‑route service and TheHandi‑Van paratransit service, providing mobility for residents, workers, and visitors across Honolulu and surrounding communities. The organisation also manages the Holo card contactless fare payment system, which enables users to purchase, reload, and validate fares online, at retail locations, and on vehicles. In addition to fare collection, Oahu Transit Services maintains real‑time GPS tracking of its fleet, a public website for schedule information, and customer service call centers that support both bus and paratransit operations. These core functions are delivered under a contract with the City and County of Honolulu, making the entity a key transportation contractor for the municipal government.

While specific employment or vehicle counts are not disclosed in the available sources, Oahu Transit Services is recognised as the primary provider of mass transit on Oahu, serving a geographic area that includes the urban core of Honolulu and the suburban and rural portions of the island. The organisation’s operational footprint is supported by a segregated information technology environment that is deliberately separated from the city’s own IT infrastructure, a design choice intended to limit the spread of cyber incidents. This segregation was highlighted during the June 2024 cyberattack, when officials noted that the city’s separate systems remained unaffected despite disruption to OTS’s online services, GPS tracking, website, and Holo card readers. The contractor’s approach to cybersecurity includes the application of zero‑trust principles and the maintenance of frequent backups, measures described by officials as part of its defensive posture against threats.

Oahu Transit Services has experienced two notable cyber incidents within a three‑year span, the most recent occurring on June 15, 2024, and an earlier event on December 9, 2021. The 2024 attack disrupted online systems, including real‑time GPS tracking, the public website, and Holo card payment terminals, while physical bus and paratransit services continued to operate with call centers remaining accessible. The 2021 incident caused widespread server outages that affected TheBus and TheHandi‑Van online operations, disabled Holo card services, and required riders to schedule paratransit trips by phone, although user financial data was reported to be stored on separate city servers and appeared uncompromised. Both attacks prompted involvement of federal law‑enforcement agencies such as the FBI and, in the 2021 case, the Secret Service, and led to network isolation efforts by the transit operator’s security team. Despite the disruptions, the organisation has emphasized that no ransom was paid in either incident and that it continues to work with authorities to investigate and restore services.