Teiss Ransomware Group Targets LA Metro, Threatens Data Leak
Article Content
- •The Gentlemen ransomware group has targeted LA Metro, demanding a response within nine days.
- •No data samples have been released, leaving the scope of the breach unclear.
- •This is the second cyberattack on LA Metro in 2026, following a major breach in March.
The Gentlemen ransomware group has claimed responsibility for targeting the Los Angeles County Metropolitan Transportation Authority (LA Metro), listing it on their dark web leak site on September 7, 2026. The group has given LA Metro a nine-day deadline to respond, but no data samples have been released yet, leaving the nature of the compromised data unconfirmed. Given LA Metro's extensive operations, which include managing ticket sales for approximately 12.9 million riders, the potential impact on passenger data could be significant. This incident marks the second attack on LA Metro in 2026, following a previous breach in March where 700 gigabytes of internal data were stolen. The transportation sector has increasingly become a target for cyberattacks, with notable incidents affecting other agencies in recent years.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Qilin and LA Metro in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000 credentials. The threat actor, known as k0t, has been active since October 2025 and is linked to ransomware groups like Qilin… 
Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure…