Back Ground.News

Iranian hackers responsible for Los Angeles transit system breach, Israeli researchers say

Ground.News • May 27, 2026

The saboteurs stole at least 700 gigabytes of emails, backups, and other files from LACMTA, a Tel Aviv-based cybersecurity firm said after discovering the misappropriated data had been inadvertently exposed online

The group’s attack was part of a broader operation targeting organizations in the United States, Israel, Saudi Arabia, and Turkey. By JNS The Israeli firm Gambit Security said on Tuesday that a group tied to the Iranian regime carried out a cyber attack against the Los Angeles County Metropolitan Transportation Authority in March. The Los Angeles Times reported in early April that a spokesman for the authority had confirmed the hack and said tha…

An Israeli cybersecurity firm said Iran’s government is behind Ababil of Minab, a fake hacktivist persona that has claimed a series of data breaches after the start of the war in Iran.

A report by Israel-based Gambit Security dismisses the hackers’ claims of being patriotic but unaffiliated activists.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Hackers Breach Los Angeles Transit System, Steal 700GB of Data In March 2026, Iranian hackers linked to the Ministry of Intelligence and Security (MOIS) breached the Los Angeles County Metropolitan Transportation Authority (LACMTA), stealing at least 700 gigabytes of sensitive data, including emails and backups. The attack, attributed to a group called Ababil of Minab, disrupted parts of the transit system's network, though bus and rail services continued to operate. Forensic evidence from Gambit Security confirmed the connection between the hackers and Iranian state operations, indicating that this was not an independent hacktivist group as claimed. The breach was part of a broader campaign targeting organizations in the U.S., Israel, Saudi Arabia, and Turkey, raising concerns about escalating cyber warfare amid ongoing geopolitical tensions. The LACMTA's internal systems were affected, leading to temporary disruptions in customer services, such as fare card reloading. Recovery from the attack took weeks, highlighting the severity of the incident. 15 sources 77

Extracted Entities

Iranian hackers responsible for Los Angeles transit system breach, Israeli researchers say

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (5)

Industries (1)

MITRE ATT&CK (2)