An August ransomware attack on the state Department of Transportation exposed personal data and disrupted bus services.