Israeli cybersecurity researchers say Iranian hackers were behind a disruptive March breach of the Los Angeles County Metropolitan Transportation Authority, which forced parts of its network offline. According to Tel Aviv based Gambit Security, the attackers stole at least 700 gigabytes of emails, backups and other files, later exposing the data online.

The researchers said forensic evidence links the breach to a known hacking operation previously attributed to Tehran. The attack was claimed by a group calling itself Ababil of Minab, whose name references a reported airstrike in Iran and whose tactics resemble those of hacker groups that Western officials believe act as fronts for Iranian intelligence.

Los Angeles transit officials said train and bus services were not halted, but some arrival screens were disabled and customers were temporarily unable to load funds onto transit cards. Authorities, including the Federal Bureau of Investigation, are investigating the incident, while the transit agency has declined to speculate on attribution.

The same group has claimed responsibility for other cyberattacks, including incidents involving a Florida commuter rail service, a vehicle tracking company and a Saudi infrastructure firm. Researchers say the hackers have also targeted additional organizations in Israel and Turkey, underscoring what they describe as an ongoing campaign of Iranian linked cyber operations.