Ransomware attack strands riders who rely on VTA’s service
Lack of initial information angers area commuters with disabilities
As she got ready to go to work last Monday morning, 40-year-old Amanda Evans expected to see the Valley Transportation Authority paratransit bus she uses for her daily commute pull up outside her Santa Clara home around 8 a.m.
The bus never showed. Unbeknownst to Evans, VTA had been struck by a cyberattack over the weekend that had forced the shutdown of many of the transit agency’s core computer systems, including the one that tracks reservations for paratransit service.
More than a week later, that apparent ransomware attack is ongoing with many computer networks still offline. VTA officials are refusing to answer questions about the extent of the breach, or whether they are in negotiations with hackers who have threatened to post private agency data online if the agency doesn’t “cooperate,” which likely means paying a ransom.
But Evans isn’t just upset about the hack. Nobody at VTA bothered to let her know her ride to work wasn’t going to be arriving as scheduled that morning, Evans said, and by the time she finally got through to the agency’s reservation line she was told nobody was
available to come pick her up.
“I can’t call an Uber, I can’t call a taxi, I can’t call a bus,” said Evans, who relies on a mobility scooter to get around. She also owns a van that can accommodate her scooter, but isn’t able to drive it herself. “If I can’t get someone to drive me in my van, or I can’t get a paratransit ride, I’m dead in the water,” she said.
VTA spokeswoman Stacey Hendler Ross said the authority sent notifications about the computer problems to “critical appointment clients,” such as those who had appointments for rides to dialysis treatment, and put a recorded message about it on a customer service line. With digital systems unavailable and workers scrambling to schedule the hundreds of paratransit trips VTA provides each day, though, Hendler Ross said broader outreach to roughly 7,000 clients in its database wasn’t feasible.
“We are working extremely hard to try and get people where they need to go, and we ask for their patience,” she said.
Still, the lack of information was frustrating for Evans.
“I have not gotten a single email or a single voicemail from them,” Evans said, “which to me is appalling — these are some of your most vulnerable residents in the county.”
Hendler Ross said Monday that many computer systems remain offline with crews working “as diligently and carefully as possible so that we aren’t vulnerable when we bring things back up.”
The online tool that lets paratransit users schedule trips is one of the affected systems. That means riders need to schedule trips by phone, at (408) 3212380, though they warn riders may experience long hold times.
Conventional bus and light rail service have continued to run through the cyberattack.
Christine Fitzgerald, a community advocate with the Silicon Valley Independent Living Center and a member of VTA’s transportation accessibility committee, said she has also heard from riders with disabilities who have reported problems making or confirming their trip reservations with the phone system since the cyberattack began.
“Having the system go down is one thing,” Fitzgerald said. “Having the system go down and not having a backup to keep it going without having this challenge? That’s a major concern.”
Evans said VTA workers have told her she can only schedule trips one day in advance, meaning she would need to call every day to arrange the commute rides that were previously scheduled automatically. She is also worried paratransit won’t be as reliable because she needs to travel during peak commute hours.
After hastily getting approval for remote work last Monday, Evans has rearranged her work schedule so a housemate can drive her the 25 minutes each way to her job at Fremont Union High School District in Sunnyvale.
“That’s my plan until they’re back up and running, I guess,” Evans said of VTA’s paratransit service. “It’s a hot mess.”