America’s railroads transport millions of people and billions of dollars’ worth of goods each and every day. As the rail network becomes more sophisticated and continues to grow in importance to national economic productivity, keeping railroads safe from cyberattacks has never been more important. At the Defend the Railroad Conference, held recently in Columbia, Maryland, transportation experts joined with cybersecurity experts to discuss how to defend America’s vital railroad infrastructure from cyberattacks.
“Railroads are a vital part of our national critical infrastructure,” shared conference attendee Eli Moser, Cyber Threat Intelligence Analyst, at Chronos Operations. “Millions of people and billions of dollars’ worth of goods are on America’s railways daily and while it’s been easy to operate railroads securely for decades, it’s becoming more challenging by the day.” What Moser refers to is the digitization and automation of rail systems in recent years, which makes them more vulnerable to cyber attacks, and would have devastating consequences for the economy and public safety.
While we’ve seen the impact of cyber attacks on banking systems, healthcare organizations, schools and universities, and commercial supply chains, there have been relatively few successful attacks on critical infrastructure including power and water supply and transportation infrastructure. However, just because cyber attacks on railroads have been rare, it doesn’t mean that they should be dismissed, or that rail authorities should not be investing in mitigation strategies and solutions. For example, in 2025 CISA issued a warning to rail authorities about train break vulnerabilities. The security flaw, if successfully executed could “enable attackers to transmit unauthorized brake control commands directly to end-of-train devices, potentially causing sudden train stoppages that could disrupt freight and passenger operations nationwide.” These disruptions would likely be far more serious than simple delays, have huge economic impacts, and even result in the loss of life.
For Moser, federal, state, and local government agencies must begin the process of securing American railroads by first modernizing legacy systems. “Many railroad systems still use outdated technology that is vulnerable to cyberattacks,” he explained. “As we’ve seen across industry and throughout the public sector, legacy technology and infrastructure is an open door to potential? hackers looking to get a foothold in a critical system to launch an attack.”
Also included in Moser’s list of greatest vulnerabilities is the vast attack surface the railroad system offers hackers. “It’s not just about the fact that railroads traverse great distances that makes them vulnerable. It’s that behind the scenes they run on connected devices and systems,” he noted. “This massive attack surface allows malfeasance to spread quickly, crippling operations. The 2022 ransomware attack on Italy’s national railway company was evidence of this.” In that instance, ransomware spread quickly throughout the Ferrovie dello Stato system, encrypting mission critical data and bringing operations to a standstill.
But these examples are just the beginning of a long list of possible attacks, which also include control systems and signaling attacks, insider threats, attacks on passenger information systems, and data breaches, all of which have significant consequences both financially and reputationally. While there are obstacles to protecting railroads from cyberattacks — including a high degree of interconnection, vast and distributed infrastructure, limited budgets, and limited employee awareness of cybersecurity best practices — these challenges can be mitigated through a strategic, enterprise-wide security approach.
Despite these obstacles and challenges, Moser has good news for railroad authorities and government agencies: there are a number of steps that can be taken to improve cybersecurity and resilience without breaking the budget. For example, adopting a secure by design approach when reviewing or rebuilding IT architecture enables cybersecurity solutions to be built in from the outset. Equally, adopting a Zero Trust security model, which transforms implicit trust of users and devices to a trust by verify model not just to access the network but as users move through the network and as they seek to use apps. “While some of these steps may seem overwhelming at first, by partnering with trusted partners in the public and private sector, railroad authorities can implement best practices, avoid pitfalls, and keep budgets under control while introducing more robust and resilient cyber controls,” he shared.
As the railroad industry becomes even more central to the movement of people and goods around the United States, being able to operate it securely must be top of mind. From maintaining strong cyber hygiene among employees to implementing the latest AI technologies to detect and respond to threats, railroad operators can take myriad steps to mitigate attacks, keep passengers safe, and ensure freight is delivered on time to distant locations. “By embracing new technologies and working with trusted partners, the railroad industry can significantly improve its cybersecurity posture and protect people, freight, and infrastructure from the ever-growing threat of cyberattacks,” Moser concluded.