Search Transit Toronto

Ransomware attack on TTC systems disrupts services



Update — Saturday, October 30, 5:09 p.m.: The TTC is also cancelling a late opening of Line 2 Bloor - Danforth between Woodbine and St George Stations that it planned for tomorrow, Sunday, October 31.


The TTC issued this news release, yesterday, Friday, October 29:

“The TTC learned today that it was a victim of a ransomware attack. Last night, TTC IT staff detected unusual activity and began investigating. Impact was minimal until midday today (Friday, Oct. 29), when hackers broadened their attack on network servers.

The incident did not cause significant service disruptions and there is no risk to TTC employee or customer safety.

“At this time, impacted services and systems include:

  • “Loss of the TTC’s Vision system, used to communicate with vehicle operators. Operators are still able to communicate with Transit Control by radio.
  • “Next Vehicle information on platform screens, through trip planning apps and on the TTC website is unavailable.
  • “Online Wheel-Trans bookings are unavailable.
  • “Internal TTC email is offline.

“The full extent of the attack is being looked into and the TTC is working with law enforcement and cybersecurity experts on this matter. The City of Toronto’s IT Services department has also been consulted on this matter.

The TTC has cancelled a single day closure planned on a portion of Line 1 between St Clair and College for track work on Saturday, Oct. 30.

“TTC IT Services are continuing to investigate the incident and the TTC will continue to share information as it becomes available.”