Greater Richmond Transit Company hit by Play ransomware over Thanksgiving

The Greater Richmond Transit Company, which runs bus and specialized transportation service for Richmond, Virginia and the surrounding Chesterfield and Henrico counties, was struck by a cyberattack over the Thanksgiving 2023 holiday weekend. The incident temporarily affected certain applications and portions of the agency's computer network.

A GRTC spokesperson said IT staff discovered the intrusion quickly and restored the network, and that outside specialists had been brought in to investigate. The agency said all services were running as scheduled and that it did not expect further disruption for riders. GRTC recorded roughly 8.7 million trips in 2022 and carried about 31,200 riders on an average weekday.

GRTC declined to say whether any data had been taken or to confirm that ransomware was involved. On December 7 the Play ransomware group listed the transit company on its dark web leak site, claiming to hold private and personal confidential data, client documents, budgets, identity documents, scans, payroll records and financial information. The group set a December 13 deadline and did not name a ransom figure.

Play had spent 2023 targeting public sector bodies, among them the city of Oakland, Dallas County and Lowell, Massachusetts. As of mid-December 2023 GRTC had not addressed the group's claims and its investigation was continuing.