BART hacked - files released on the darknet

01/15/2023Darknet News, USA

Several news outlets are claiming that BART police files, including charges of child abuse against officers and even your information if you’ve ever been cited by BART Police for a crime, have been hacked and released onto the dark web.

The recent NBC News report that a hacking gang had seemingly ransomed BART’s internal systems and released a “enormous trove of sensitive material” into the dark web may have put BART police officers on high alert. There are reportedly 120,000 internal BART files, largely likely those of the Human Resources department and “containing specific complaints of child abuse,” according to NBC News, which has studied the stolen and released data.

According to some more information from the Bay Area News Outfit, Vice Society, a reputable and well-established ransomware group, is claiming responsibility for the hack. The goal of that specific hacker gang is to exchange the stolen data for ransom payments by breaking into hospitals, schools, and other public institutions.

BART maintains that the hack won’t have an impact on ridership, but by doing so, they appear to be admitting that it did happen. To be clear, neither internal business systems nor BART services have been harmed, according to Alicia Trost, a BART spokesman, who spoke to the Bay Area News Group. “Like other government entities, we are preparing to respond by taking all required steps.”

Email addresses and passwords

According to cybersecurity experts speaking to NBC News, the fact that these files are now accessible online is a clear sign that BART declined to pay the ransom.

This does not initially appear to be as serious as the 2011 BART Police Officers Association breach by a hacker associated with Anonymous (though SFist has not reviewed the hacked data). More than 100 officers’ email addresses, passwords, and personal information were exposed in that 2011 attack.

But if BART police have ever issued a citation against you for a crime, then sure, there is a possibility such information was among the data that was released.

More sinisterly, “At least six scanned, unredacted reports outlining suspected child abuse are among the files,” claims NBC News. These reports include the names and birthdates of the children who are in danger, as well as descriptions of the adult who may have allegedly abused them.

The information appears to also include names and driver’s license numbers of BART contractors, hiring documentation for BART police applicants, and mental health records for officers submitted for mental health exams.

The horse is practically out of the barn once it appears on the dark web. According to cybersecurity expert Brett Callow, who spoke to the Bay Area News Group, “it’s frequently the case that other people scrape the data.” “Once the information is uploaded on these websites, it is impossible to predict where it will go or what other users may do with it.”