Auckland Transport ticketing systems disrupted by ransomware attack

Auckland Transport, the council-controlled organisation responsible for public transport and roads across New Zealand's largest city, reported in mid-September 2023 that a suspected ransomware attack had taken parts of its systems offline. The disruption became public on 14 September.

The outage centred on the AT HOP integrated ticketing and fares platform. Online top-ups and MyAT HOP account services were unavailable, ticket and top-up machines accepted cash only because card payments had stopped working, customer service centres ran with limited functionality, and retail agents could not top up cards or load concessions. Buses, trains and ferries kept running, and staff were told to let passengers travel even if their cards were empty.

Auckland Transport said early indications pointed to ransomware, that the incident appeared isolated to one part of its systems, and that no personal or financial data had been accessed. It engaged external specialists and initially expected services to be restored early the following week.

The Medusa ransomware group later listed the agency on its darknet site, according to Cyber Daily, seeking one million US dollars to delete the stolen data and the same sum from any buyer. Chief executive Dean Kimpton said the organisation had no interest in engaging with the illegal and malicious activity. In a further update on 29 September, Auckland Transport reported a suspected denial-of-service attack on its website and repeated that it was confident no customer or financial data had been compromised.