A PulseConnect appliance belonging to the New York MTA was exploited at the beginning of 2021, possibly by a Chinese-backed actor, via a Pulse Secure VPN zero-day.
Transit systems systems weren’t accessed and it is believed no data was taken.
No
A cyber attack is a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.
Michael Schmitt et al; Tallinn Manual 1.0, pp 92
- ✅ Cyber Operation?
- ❌ Expected to cause death or injury to people or damage to objects?
Chinese-linked Actors Probing The New York MTA's PulseSecure VPN does not match this definition. Here's a list of actual cyberattacks and and why this matters.