The Egregor gang disrupted the Vancouver metro system with a ransomware attack on Dec. 1. The attack prevented Translink users from using their metro cards or buying tickets at kiosks. Translink officials avoided acknowledging the attack for two days, passing it off as a technical issue before being pressed by multiple local news agencies about what really was going on. The ransom note that accompanied the attack points to the group as the culprit. The group also is at this time the only known to run scripts that cause printers at the organization to print out the ransom note.
Source: https://threatpost.com/vancouver-metro-egregor-ransomware/161892/