The ransom gang grabbed files belonging to a bunch of organizations, not just the Transit Police. It was a breach of a 3rd party software maker who hosts files. They're most likely holding the data for ransom.