Reuters: Iranian Hackers Responsible for Los Angeles Transit System Breach
Reuters reports on Gambit Security's investigation showing that the destructive March attack on the Los Angeles County Metropolitan Transportation Authority — where attackers stole at least 700 GB of emails, backups, and files — was the work of Iran's MOIS operating behind the Ababil of Minab hacktivist persona.
May 26, 2026
Reuters reported on Gambit Security's investigation into the March cyberattack that forced parts of the Los Angeles County Metropolitan Transportation Authority (LACMTA) offline. Gambit researchers discovered at least 700 GB of stolen LACMTA emails, backups, and files inadvertently exposed online — and matched the server to a previously known hacking operation Israeli officials and researchers have attributed to Tehran.
The findings undercut the "hacktivist" cover story used by Ababil of Minab, the group that claimed credit for the attack. Gambit's analysis ties Ababil to additional intrusions at Tri-Rail, vehicle-tracking firm Vyncs, Saudi infrastructure firm Unimac, and undisclosed targets in Israel and Turkey — a pattern consistent with state-directed activity rather than a standalone crew.
Related from Gambit:
• Blog: "Ababil of Minab: Iran-linked destruction and exfiltration campaign" (May 25, 2026) — the full technical report behind the Reuters story.
