tldr hackers are from DragonSector (one of the top CTF teams) - https://dragonsector.pl/

They were contacted by workshop which was doing maintenance of those trains and had no idea why they stopped working