The agency did report the attack to law enforcement services but did not disclose it to the public.
According to the newspaper, the hackers failed to access the systems that control train cars and thus did not jeopardise the safety of passengers.
The criminals are said to have accessed only three of the 18 computer systems, including those used by New York City Transit, which is responsible for the subway and buses.
Recently, there has been an uptick in hacking attacks against US infrastructure's computer networks, such as the Colonial Pipeline and SolarWinds incidents. Addressing the issue, US President Joe Biden has launched a rapid strategic review to curb the escalating cyberattacks, also planning to create an international coalition against hacking.