Auckland Transport

Auckland Transport, also known as AT, is the organisation responsible for managing Auckland's public transport system in New Zealand. It operates the HOP card contactless ticketing system. The organisation provides digital channels for customers to top up their HOP cards and make card payments online. Physical top‑up options remain available through retail outlets and ticket machines. AT also maintains a public website that delivers service information and supports online transactions.

In September 2023 Auckland Transport faced two distinct cyber incidents that affected its digital services. On 13 September a ransomware attack attributed to the Medusa group encrypted part of the HOP card transaction database, disabling online top‑ups and card payments while leaving physical tagging and travel unaffected. The compromised system was isolated and taken offline for rebuilding, with full restoration anticipated within a week. On 29 September a second attack combined ransomware threats with a denial‑of‑service barrage that flooded the AT website with malicious traffic. The Medusa group demanded a one‑million‑dollar payment to prevent the release of customer financial data, but Auckland Transport refused to engage, asserting that no personal or financial data had been compromised. Throughout both incidents the organisation emphasised that core HOP functionalities such as card tagging and physical top‑up options continued to operate, and it apologised for the inconvenience experienced by customers.