NTD cybersecurity reporting: why the database holds only nine transit cyberattacks

The National Transit Database has a category for cyberattacks, and since January 2014 it has filled it nine times. That is nine events out of 116,364 major safety and security events in FTA’s public major events dataset, and out of 22,855 security events, a group that also holds robberies, bomb threats, and assaults. FTA does not think nine is the real number. In the October 2024 proposal that led to the 2025 reporting changes, the agency wrote that it had “reason to believe that there have been dozens of breaches, ransomware, and other cyber events on transit agencies” over the same period, based on its own analysis of media coverage.

NTD cybersecurity reporting is older than the 2025 changes make it look. A full reporter that suffers a cyber event meeting a major event threshold files it on the S&S-40 major event form, the same form used for a derailment or an assault, and has been able to for years. What changed in 2025 is the reading of the rules that decides whether an attack on an agency’s computers counts. FTA’s final notice of July 2025 says so directly: “the NTD already collects cyber security events; this is not a new reporting requirement.” For who reports to the NTD and how to pull its data, see our explainer on the National Transit Database.

What counts as a cyber event

The definition comes from FTA’s Safety and Security Policy Manual, quoted in the 2024 proposal. A cyber security event is “an event that targets transit facilities, personnel, information, or computer or telecommunications systems associated with transit agencies.” The NTD glossary fills that out with five kinds of event: denial or disruption of computer or telecommunications services, with train control singled out; unauthorized monitoring of those systems; unauthorized disclosure of information stored in or passing through them; unauthorized modification or destruction of code, databases, or stored information; and manipulation of systems for fraud, financial loss, or other crimes.

FTA classes cyber events as system security events, meaning events that affect “a transit system as a whole” rather than one vehicle or station. The proposal adds a line that settles a common question: an event is a cyber security event when a third party causes it. If a transit employee does the damage, the event is reported as sabotage.

To reach the database, an event also has to qualify as a major event, and that test screened out nearly every transit cyberattack.

Why so few reached the database

Under the NTD rules the proposal quotes, an event is reportable as a major event when it meets a threshold and also happens in one of four places or circumstances: at a revenue facility, maintenance facility, or rail yard; on transit right-of-way or infrastructure; during transit-related maintenance; or involving a transit revenue vehicle. The proposal names the threshold cyber events most often meet: property damage.

The test turned on the word infrastructure. FTA’s proposal admits that the agency “historically has interpreted ‘infrastructure’ to include only physical assets for both cyber security and other safety and security events.” Read that way, ransomware that encrypts a scheduling server or a breach of a payroll system did not happen on transit infrastructure at all, unless it also damaged something physical. An attack could take down trip planning or fare collection for a week and still sit outside the NTD’s definition of an event worth reporting.

Rail modes faced a second hurdle. For them, one of the major event thresholds is substantial damage, which the NTD defines as damage that both disrupts the rail agency’s operations and “adversely affects the structural strength, performance, or operating characteristics” of an asset so that it needs towing, rescue, on-site maintenance, or removal before safe operation. The towing and rescue language describes a damaged railcar far more naturally than a compromised network.

What the 2025 clarifications change

FTA proposed three changes in October 2024 and adopted all of them as proposed in the July 2025 final notice, effective in calendar year 2025 as soon as practicable after publication. They apply to full reporters, the agencies that file the S&S-40.

Clarification	Before	From calendar year 2025
Infrastructure	Physical assets only	Also the information, computer, and telecommunications systems in any transit facility the agency reports on its annual facilities form
Mode	One S&S-40 per affected mode, so a single attack could produce several reports	One designated mode for every cyber event: a rail mode for any rail agency, otherwise bus, otherwise demand response, otherwise ferry
Substantial damage (rail)	Must disrupt operations and adversely affect the asset’s performance	A cyber event is presumed to meet the second part, so it only has to disrupt operations

The infrastructure change is the broadest of the three. It brings an agency’s IT systems inside the definition, and FTA notes it applies to sabotage, vandalism, and power failures that damage those systems too. The mode rule is a fix to the reporting software: FTA collects major events in its Appian system, and the S&S-40 accepts only one mode per report, so agencies with bus and rail were filing duplicates of the same attack. Under the hierarchy, an agency that runs both heavy and light rail picks between them with the NTD’s Predominant Use Rule.

The rail presumption rests on FTA’s reading that a cyber event which disrupts operations will need remediation before service is restored, and the proposal cites NIST’s recovery guidance for it. In practice it means the question for a rail agency becomes whether the attack disrupted operations. The proposal lists examples that do: ransomware or a denial-of-service attack that disrupts operations, communications outages covering phone lines, websites, digital signs, and apps, shutting systems down to protect personal data, severing connections to other systems, being unable to collect fares, and being unable to assign routes or make pull-out. It also lists what does not: an employee installing an unapproved maintenance utility, non-malicious software changes, and accidents with no malicious actor.

FTA took eight comments on the cyber proposals: four opposed, three in support, and one asking for clarification. The objections were practical. One commenter said its county IT department logs cyber events for the whole county without separating transit. Three said the reporting duplicates what agencies already send to the Transportation Security Administration and to CISA, and asked FTA to get the data from those agencies instead. FTA declined to drop the requirement, said a county-wide incident can be reported with aggregate data when transit details cannot be separated, and defined a reportable event on shared infrastructure as one that occurs in any transit facility, meets a major event threshold, and is caused by a malicious third party. It also repeated that the primary reporter or contract holder files the event.

The nine events, one by one

We pulled every row the dataset files under the Cyber event type, then searched the descriptions of all 116,364 events for terms like ransomware, malware, hacked, data breach, and unauthorized access to catch attacks filed under another type. That sweep found nothing new; the only matches were people who gained unauthorized access to the roof of a train. The four events dated before 2024 match FTA’s own statement that four cyber events reached the NTD between 2014 and June 2024. A fifth, Honolulu’s, is dated June 14, 2024, inside that window; the dataset generally publishes events at least 90 days after they occur, so it may simply have landed after FTA counted. The notice does not say when the count was taken.

Event date	Agency	Filed under	Damage field	What the agency wrote
2019-02-17	Rock Island County Metropolitan Mass Transit District	Motorbus	$350,000	Computer system “compromised by a ransom virus”
2021-04-17	Santa Clara Valley Transportation Authority	Light rail	Substantial damage	Unauthorized access to the VTA network; files corrupted or damaged
2023-02-15	Pierce Transit	Motorbus	$47,030	Cyberattack; personal information leaked; insurance claim filed
2023-10-01	Bi-State Development Agency (St. Louis)	Demand response	$60,000	Cyber security event “company wide for approximately 2 weeks”
2024-06-14	City and County of Honolulu	Motorbus	$229,921	Cyberattack on Oahu Transit Services’ computer system
2024-10-14	SouthWest Transit	Motorbus	$50,000	Personal and accounting information accessed through email
2024-12-19	Pittsburgh Regional Transit	Light rail	Substantial damage	Ransomware; about three hours of rail disruption; a tunnel closed while a gate server was affected
2025-08-23	Maryland Transit Administration	Light rail	Substantial damage	Unauthorized access; paratransit unable to book or rebook trips; real-time information and call centers affected
2026-03-25	Denver Regional Transportation District	Light rail	Substantial damage	Employee socially engineered; several accounts and 15 endpoints compromised

The two threshold regimes show up in the damage column. The bus and demand response rows carry a dollar figure in the property damage field, which the dataset defines as the estimated value of damaged property, and these are the agencies’ own estimates. Pierce Transit’s description itemizes its claim, but the numbers in the published text are garbled, so take the $47,030 total as reported and nothing finer. The rail rows carry no dollar figure. They carry the substantial damage flag instead, which is the threshold the 2025 presumption now makes easier to meet.

The mode column is where the clarification shows. Before it, Bi-State filed its 2023 event under demand response, though the agency runs light rail, and Honolulu filed its 2024 event under motorbus, though its rail line was already in the dataset with major events of its own from 2021. Under the hierarchy, both would now go under rail. Pittsburgh, Maryland, and Denver all run bus and rail, and all three filed under light rail. On these rows the mode field is a filing convention, and it says little about what was attacked. Pittsburgh’s light rail was disrupted, but Maryland’s description names paratransit booking and real-time information, and Denver’s names staff accounts and endpoints.

The descriptions also show what these attacks hit. Most of these rows describe business systems, personal data, and customer services rather than vehicles or signals. Where operations did stop, it was through the systems around the service: a gate server, a trip booking tool, real-time information. That is the dispatch and scheduling layer described in our piece on what a CAD/AVL system does, and it is the layer the infrastructure clarification now brings inside the rules.

What the count still misses

FTA’s “dozens” came from news coverage, and some of the attacks it could have meant are easy to find. In November 2016, San Francisco’s Muni turned off ticket machines and gates at subway stations over a holiday weekend while it cleaned up ransomware, though the agency said train and bus operations were not affected. In November 2017, an attack on Sacramento Regional Transit erased parts of the programs the agency used “to dispatch employees and assign buses for routes.” In August 2020, malware halted SEPTA’s real-time travel information for about two weeks and paused routine scheduling for its paratransit service.

None of the three is in the dataset. All three agencies file major events, but none has ever filed a cyber row. That is not evidence that anyone skipped a required report. Under the physical-assets reading FTA itself describes, an attack that switched off fare gates or wiped a dispatch server without damaging anything physical did not occur on transit infrastructure. The 2024 proposal’s new examples of disruption read like descriptions of these cases: inability to collect fares, inability to assign routes or make pull-out, and outages of the apps and digital signs that carry real-time information.

The other place these attacks go is TSA. Its current security directive for public transportation and passenger railroads, SD 1582-21-01E, effective January 16, 2026, requires covered operators to report cybersecurity incidents to CISA no later than 72 hours after identifying them. Its bar is far lower than the NTD’s: unauthorized access to an information or operational technology system, or the discovery of malicious software on one, is reportable on its own, without any damage threshold. But the directive covers rail operators and excludes bus-only operations, and everything reported under it is Sensitive Security Information. So a covered rail agency can owe two reports for one attack, as the commenters said, but only the NTD publishes what it collects, and only the NTD reaches a bus-only agency.

What it means for an agency

For a full reporter, the practical change is that an attack on the agency’s IT no longer gets filtered out by the word infrastructure. If a third party gets into a system in a transit facility and the attack meets a major event threshold, it goes on the S&S-40. A rail agency’s test is short: did it disrupt operations, read broadly enough to include fares, route assignment, signs, apps, and the website. A bus-only agency still needs the event to meet a threshold such as property damage, and the five bus and demand response rows above show agencies reporting the cost of the attack in that field, from $47,030 to $350,000.

The filing details are now settled too. File once, under the designated mode, not once per mode affected. If the attack came from inside, it is sabotage, not cyber. If the county runs the network and cannot separate transit’s share, report the aggregate. If a contractor’s systems were hit, the primary reporter or contract holder files, as Honolulu did for Oahu Transit Services. A rail agency covered by the TSA directive still owes CISA its report within 72 hours; FTA’s position is that the NTD report is a separate obligation with a separate purpose.

What to watch

The clarifications have been in force since the second half of 2025, 2026 is the first full year under them, and the dataset runs about a quarter behind, so the effect is only starting to show. The dataset holds two cyber events dated after the final notice, in Maryland in August 2025 and Denver in March 2026, which is not yet a trend, and it only covers events through June 2026. If the infrastructure reading works the way FTA intends, the next several releases should carry more cyber rows than any year so far, and more of them from rail agencies, where the presumption lowers the bar. If they do not, the gap FTA described in 2024 is still open.

The other thing to watch is the descriptions. FTA said it wants the data to spot trends and target technical assistance. The nine free-text paragraphs are enough to see that most of these attacks hit business and customer systems rather than train control. They are not enough for trend analysis, and the dataset has no structured field for what kind of attack it was or which system it reached. Every count in this piece is from the dataset as updated on October 6, 2026, and will change as new months are published.