Hackers leak sensitive files after attack on San Francisco transit police

Criminal hackers have posted an enormous trove of sensitive files to the internet from a San Francisco Bay Area transit system’s police department, including specific allegations of child abuse.

The breach comes from the Bay Area Rapid Transit System (BART) Police Department. BART’s chief communications officer, Alicia Trost, said in an email officials were investigating the posted files and that the hackers had not impacted BART services. It’s unclear when the hack occurred.

The perpetrators are an established group of ransomware hackers, one of the many who attack specific organizations and either encrypt sensitive files or threaten to post them on the dark web. The website the BART Police leaks were posted includes more than 120,000 files, according to an NBC News review. 

At least six scanned, unredacted reports detailing suspected child abuse are among the files. Those reports state the name and birthdates of endangered children, and in some cases give descriptions of an adult and the alleged abuse. 

• Add to Google

Hospital ransomware attacks put patients at risk

02:53

Ransomware hackers often demand a payment to not share files. Trost declined to share additional information, but the fact that the files are now online indicates that BART refused to pay, said Brett Callow, an analyst at the cybersecurity firm Emsisoft.

The website also has mental health record forms, in which an officer can recommend someone for mental health evaluation. Other files include the names and driver’s license numbers of contractors who have worked on BART projects, police reports that name suspects for various crimes, and hiring documents for prospective officers.

Though it’s still rare for such sensitive police files to be leaked, cyber extortion attacks on U.S. public sector organizations, including police departments, have become increasingly common.

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSRecords reveal tumultuous marriage between killed New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

More than 100 networks associated with local government agencies were successfully attacked by ransomware hackers last year, according to an Emsisoft survey. The Treasury Department has estimated that ransomware attacks cost U.S. organizations $886 million in 2021, the most recent year for which it has published data. 

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSRecords reveal tumultuous marriage between killed New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

“Unfortunately, not enough progress has been made in securing public sector organizations,” Callow said. “They can compromise investigations, resulting in exceptionally sensitive information leaking online, and even put people’s lives at risk — both officers and the public's.”

In 2021, a different hacker gang breached the Washington, D.C., Metropolitan Police Department and leaked sensitive profiles of 22 officers when it refused to pay. 

It’s also common for such hackers to attack school districts. Des Moines Public Schools closed classes Tuesday due to a “cyber security incident,” a term often used to describe a ransomware attack. Almost 2,000 U.S. schools were impacted by ransomware in 2022, Emsisoft found.