������Ƶ

Usually, when Lei Kema has a doctor’s appointment, she reserves a Handi-Van to get there. 

However, for her back-to-back appointments scheduled for Friday morning the 83-year-old Ahuimanu resident said she might take TheBus instead.

That’s because a cyberattack early Thursday morning left Handi-Van employees unable to access the reservations that Oahu’s senior and disabled passengers recently booked for one of the busiest paratransit services in the nation.

“Their hands are tied,” Kema said of officials at Oahu Transit Services, the company that runs TheBus and Handi-Van for the city. “This is a terrible, terrible thing to happen.”

The attack on OTS’ servers took place around 1 a.m. Thursday and left Handi-Van dispatchers and drivers scrambling to rebook as many of the service’s 2,500 or so daily rides as they could, city transit officials said.

The city’s Department of Transportation Services put out word on Thursday morning for Handi-Van passengers who had booked a ride to call and rebook. Meanwhile, reservationists coordinated with the fleet of 120 or so drivers across Oahu using radio instead of the usual digital software to pick those passengers up, according to Roger Morton, the city’s DTS director.

Handi-Van managed to accommodate everyone who called to reschedule, Morton said, although it’s not clear how many previously booked rides fell through the cracks. Oahu Transit Services also used previous reservation logs to schedule recurring rides on Thursday.

The incident had the “trappings of a ransomware attack,” in which someone hacks into a computer system and demands payment to release it, Morton said during a press conference.

However, neither the city nor OTS had received a demand for payment, Morton added.

The Honolulu Police Department, the Federal Bureau of Investigations and the Secret Service, which is a branch of the U.S. Treasury Department, were investigating, city officials said.

The city doesn’t believe that any sensitive financial information was compromised in the breach, although the OTS servers contain passenger names and addresses, Morton said. He added that the attack was isolated to OTS’ servers, and the city had severed the connection between its own servers and OTS’ once it suspected an attack was underway. 

The lost Handi-Van reservations weren’t the only casualty of the attack; internal operations also were disrupted when OTS lost its servers, officials say.

TheBus suffered “little to no delay in service,” although operation of its HOLO payment card and call center went down. Drivers were told to let riders on board if they had a HOLO card with them, and riders could still pay with cash.

It’s not clear when the OTS servers might be restored – “assuming we can do that,” Morton said. Transit officials are attempting to “rebuild” the lost servers using backed-up data, he said.

In the meantime, OTS and the city will use the “improvised” reservation system to book new rides and direct Handi-Van drivers around the island.

Meanwhile, Handi-Van customers looking to book rides before 9 a.m. Friday should call the reservation line by 10 p.m. Thursday, said Deputy Transportation Services Director Jon Nouchi.

The number is 808-456-5555 – although the line was experiencing heavy demand on Thursday evening.

In pre-pandemic days, the Handi-Van would handle around 4,000 daily trips. That demand has dropped considerably, which has helped city and OTS officials respond to the cyberattack, Morton said.

Kema said she’s used the service since 2004, when she had a stroke, and that she’s never seen anything like this happen.

She’s fortunate that TheBus could accommodate her, and she has a scooter to rely on, but she worries about other riders who lack those options.

“I feel for them right now and what they’re going through,” she said of the Handi-Van drivers and employees. “It’s very sad.”