The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Scattered Spider's 2024 Cyberattack on Transport for London: A Case Study
Between August 31 and September 3, 2024, the cybercriminal group Scattered Spider executed a sophisticated cyberattack on Transport for London (TfL). Utilizing social engineering techniques, they infiltrated TfL's network, leading to significant disruptions in technical services, including the Oyster payment system and third-party APIs. The attack necessitated a mass password reset for all 28,000 TfL employees and resulted in financial losses estimated at £29 million. ([nationalcrimeagency.gov.uk](https://www.nationalcrimeagency.gov.uk/news/cyber-criminals-who-hacked-into-transport-for-londons-computer-network-are-convicted?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups employing advanced social engineering tactics to target critical infrastructure. Organizations must enhance their cybersecurity measures, particularly in employee training and network security protocols, to mitigate such risks.
2 months ago
Kill Chain
Scattered Spider's 2024 Cyberattack on Transport for London: A Case Study
In August 2024, Transport for London (TfL) suffered a significant cyberattack orchestrated by the Scattered Spider hacking group. The breach disrupted internal systems and online services, including Dial-a-Ride, concessionary travel cards, digital payments, and contactless ticketing. Approximately 148 systems were rendered inoperable, and all 27,000 TfL employees were required to reset their passwords in person. The attack resulted in £29 million in losses and recovery costs, with potential economic damages estimated at up to £56 billion had the transport network been fully compromised. This incident underscores the escalating threat posed by cybercriminal groups like Scattered Spider, known for their sophisticated social engineering tactics and targeting of critical infrastructure. The successful prosecution of the perpetrators highlights the importance of early cooperation between organizations and law enforcement in mitigating cyber threats and bringing offenders to justice.
2 months ago
Kill Chain
HelloNet APT Campaign: Exploiting ViPNet Updates in 2026
In May 2026, a sophisticated Advanced Persistent Threat (APT) campaign named 'HelloNet' targeted major Russian organizations across sectors such as government, energy, transport, education, and logistics. Attackers exploited the ViPNet update system, a software suite for creating secure networks, to deploy malicious modules. By leveraging DLL Sideloading techniques, they achieved persistence and executed payloads that facilitated reconnaissance and data exfiltration. The campaign remains active, posing significant risks to affected entities. ([securelist.ru](https://securelist.ru/tr/hellonet-vipnet/116327/?utm_source=openai)) This incident underscores the growing trend of supply chain attacks, where trusted software update mechanisms are hijacked to distribute malware. Organizations must enhance their security postures by implementing robust monitoring of software updates and employing advanced threat detection systems to mitigate such risks.
2 months ago
Kill Chain
Scattered Spider Hackers Sentenced for 2024 TfL Cyberattack
Between August 31 and September 3, 2024, Transport for London (TfL) experienced a significant cyberattack orchestrated by the Scattered Spider hacking group. The attackers, Thalha Jubair and Owen Flowers, exploited social engineering techniques to infiltrate TfL's network, leading to the compromise of personal data belonging to approximately 10 million customers. The breach resulted in substantial operational disruptions, including the inoperability of 148 systems and the necessity for all 27,000 employees to reset their passwords in person. The financial impact was severe, with losses and recovery costs totaling £29 million. ([nationalcrimeagency.gov.uk](https://www.nationalcrimeagency.gov.uk/news/cyber-criminals-who-hacked-into-transport-for-londons-computer-network-are-convicted?utm_source=openai)) This incident underscores the escalating threat posed by sophisticated cybercriminal groups employing advanced social engineering tactics. Organizations must prioritize robust cybersecurity measures, including comprehensive employee training and the implementation of phishing-resistant multi-factor authentication, to mitigate the risks associated with such attacks.
2 months ago
Kill Chain
Critical Vulnerability in NASA's cFS Health & Safety Application: CVE-2026-15352
In July 2026, a critical vulnerability (CVE-2026-15352) was identified in NASA's Core Flight System (cFS) Health & Safety (HS) Application. This flaw allows attackers to trigger a segmentation fault by sending a routine Housekeeping Telemetry request, leading to a denial-of-service condition. The vulnerability affects versions of the HS application prior to v7.0.1. NASA has released an update to address this issue and recommends users upgrade to v7.0.1 to mitigate the risk. ([software.nasa.gov](https://software.nasa.gov/software/GSC-18476-1?utm_source=openai)) This incident underscores the importance of timely software updates in mission-critical systems. As space exploration technologies become increasingly reliant on software, ensuring the security and reliability of these systems is paramount to prevent potential disruptions and maintain operational integrity.
2 months ago
Kill Chain
Cyberattack on Nihon Kotsu Disrupts Taxi Services Across Japan
In July 2026, Nihon Kotsu, Japan's largest taxi operator, experienced a cyberattack that compromised its internal systems, leading to the shutdown of critical infrastructure, including the taxi dispatch system. The attack occurred early Saturday morning, prompting the company to implement emergency measures to prevent further damage. As a result, services such as car hire, web booking, reservation management, and telephone dispatch remain unavailable. The company has engaged external cybersecurity experts to investigate the incident and assess potential data leaks. Customers are advised to use the 'GO' taxi app or visit nearby taxi stands for services. This incident underscores the escalating threat of cyberattacks targeting critical infrastructure and essential services. Organizations must prioritize robust cybersecurity measures and incident response plans to mitigate operational disruptions and protect sensitive data.
2 months ago
Kill Chain
Critical Vulnerability in Schneider Electric Easergy MiCOM Px40 Series: CVE-2026-4832
In April 2026, Schneider Electric disclosed a vulnerability (CVE-2026-4832) in its Easergy MiCOM Px40 Series protection relays. The flaw involves hard-coded credentials within the SNMP interface, allowing unauthenticated attackers to access sensitive device information. Affected models include Easergy MiCOM P14x, P24x, P341, and others, with versions prior to specific firmware updates being vulnerable. The vulnerability has a CVSS v4.0 score of 6.9, indicating a medium severity level. This incident underscores the critical importance of securing industrial control systems against unauthorized access. The use of hard-coded credentials is a known security risk, and organizations must prioritize updating firmware and implementing network protections to mitigate such vulnerabilities.
2 months ago
Kill Chain
OpenPLC v3 Vulnerability CVE-2026-14480: A Critical Threat to Industrial Control Systems
In July 2026, a critical vulnerability (CVE-2026-14480) was identified in OpenPLC v3, an open-source programmable logic controller widely used in industrial control systems. This flaw allows authenticated attackers to write arbitrary files to the filesystem, potentially leading to remote code execution with the privileges of the OpenPLC runtime user. Exploitation could result in unauthorized control over industrial processes, posing significant risks to critical infrastructure sectors such as manufacturing, energy, transportation, and water systems. The discovery of this vulnerability underscores the ongoing challenges in securing industrial control systems, especially those relying on open-source solutions. As cyber threats targeting critical infrastructure continue to evolve, it is imperative for organizations to proactively assess and mitigate vulnerabilities to prevent potential disruptions and ensure operational resilience.
2 months ago
Kill Chain
Hydro-Québec Charging Station Vulnerabilities Highlight Critical Infrastructure Risks
In July 2026, Hydro-Québec's Le Circuit Electrique charging station backend was found to have multiple critical vulnerabilities, including improper access control, insufficient session expiration, and lack of throttling on authentication attempts. These flaws could allow attackers to escalate privileges or execute denial-of-service attacks, potentially disrupting electric vehicle charging services across Canada. Hydro-Québec has since updated the majority of charging stations to disable the Open Charge Point Protocol (OCPP) and implemented authentication systems to mitigate these risks. This incident underscores the growing cybersecurity challenges in the electric vehicle infrastructure sector. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential disruptions and maintain public trust in sustainable transportation solutions.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Digi International's PortServer TS and Digi One SP IA Devices
In July 2026, Digi International disclosed two significant vulnerabilities affecting their PortServer TS and Digi One SP IA devices. The first, CVE-2026-12352, allows unauthenticated attackers to bypass authentication mechanisms, granting unauthorized access to restricted resources. The second, CVE-2026-12948, is a stored cross-site scripting (XSS) vulnerability that enables authenticated administrators to inject malicious scripts into system configuration fields, which execute in the browsers of users viewing the affected pages. These vulnerabilities pose risks of unauthorized access, credential theft, and potential system compromise. The disclosure of these vulnerabilities underscores the critical importance of securing networked devices, especially those integral to industrial control systems. Organizations must prioritize timely firmware updates and implement robust network segmentation to mitigate such risks. This incident highlights the ongoing challenges in maintaining the security of legacy systems and the necessity for continuous monitoring and proactive defense strategies.
2 months ago
Kill Chain
Critical Security Flaws Discovered in EVoke Systems' Charging Station Management System
In June 2026, multiple critical vulnerabilities were identified in EVoke Systems' Charging Station Management System (CSMS), potentially allowing attackers to gain unauthorized administrative control over charging stations or disrupt services via denial-of-service attacks. The vulnerabilities include missing authentication for critical functions, improper restriction of excessive authentication attempts, insufficient session expiration, and insufficiently protected credentials. These flaws affect all versions of EVoke CSMS and pose significant risks to the energy and transportation sectors worldwide. The discovery of these vulnerabilities underscores the growing cybersecurity challenges in the electric vehicle infrastructure. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential disruptions and safeguard user data.
3 months ago
Kill Chain
Operation Endgame: A Landmark Blow to Cybercriminal Networks in 2026
In June 2026, Europol, in collaboration with international law enforcement agencies and private sector partners, executed Operation Endgame, a coordinated effort targeting the infrastructure supporting the SocGholish, Amadey, and StealC malware networks. This operation led to the dismantling of 326 servers and 142 domains, the recovery of 27 million stolen login credentials, and the seizure of over €41 million in cryptocurrency assets. The SocGholish malware, linked to the Russian cybercriminal group Evil Corp, had compromised nearly 15,000 legitimate websites to distribute malicious software. Amadey and StealC were utilized to gain initial access to systems and exfiltrate sensitive data, respectively. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai)) This operation signifies a strategic shift in combating cybercrime by disrupting entire malware ecosystems rather than focusing on individual threats. The success of Operation Endgame underscores the effectiveness of international cooperation and public-private partnerships in addressing large-scale cyber threats. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports