Anonymous breaches San Francisco's public transport site

IDG News Service - The hacking collective Anonymous released personal data on Sunday belonging to more than 2,000 public transport customers in the San Francisco area in retaliation for the Bay Area Rapid Transit (BART) system's shutdown of mobile phone service on Thursday night.

The data came from myBART.org and consists of user names, last names, addresses and telephone numbers for riders who used the website to manage their accounts. On Monday, the site was a blank white page with the message that it was unavailable for "renovation."

The attack comes after BART shut off mobile-phone service to hundreds of thousands of commuters on Thursday night. The agency claimed that riders planned a disturbance that threatened the safety of other passengers. The shutdown meant passengers could not dial emergency services.

BART, which has its own police force, has been criticized for the fatal shootings of two men over the last two years by its officers. Charles Hill, a 45-year-old homeless man, was fatally shot after he confronted police with a knife. In 2009, Oscar Grant was shot in the back during a scuffle with police.

In a statement, BART said personal information for 2,400 of its 55,000 users of the myBART.org website were affected. The website has been shutdown, and law enforcement has been notified, BART said. No financial information was stored on the site, it said.

But BART warned that people should be alert they could be targeted by scammers because of the breach. BART also provided information for how users can request a free credit report.

"We are sorry this intrusion into the myBART data occurred, and we notified those affectedright away in case anyone tries to exploit the information," the agency said. "We will provide an update as soon as we have additional information."

Anonymous publicly posted the data. The domain for that website, which uses the country code top-level domain for Austria, was blank except for a message in German that read "Back soon, do not worry."

Anonymous has been tweeting about the action under the hashtag #OpBART and under a Twitter account "OpBART."

"We apologize to any citizen that has his information published, but you should go to BART and ask them why your information wasn't secure with them," the group wrote. "Also do not worry, probably the only information that will be abused from this database is that of BART employees."

Anonymous said the database that was compromised was vulnerable to SQL injection attack, a common hacking method that involves inputting commands into a web-based form to see if the backend database storing the data responds. Secure databases will filter out commands that are not allowed if configured properly.

The group also said it would hold a peaceful protest at 5 p.m. Monday at Civic Center Station, near San Francisco's City Hall.

Send news tips and comments to jeremy_kirk@idg.com