<p><?tk 4?>Understanding factors that affect subway network vulnerability is essential for improving system resilience and operational efficiency. This study introduces a detailed data-driven framework to evaluate factors affecting the severity of disruptive events and identify critical subway network stations. Using the Toronto subway system as a case study, we integrate historical incident data, passenger demand patterns, and individual riders’ trips reconstructed using Wi-Fi device connections within the subway network to analyze the impacts of disruptions. To quantify the impact of different factors on disruption severity, we apply a limit state function (LSF) framework and develop both linear and generalized additive regression models. The findings indicate that incident severity extends beyond simple measures like duration and is influenced by factors such as incident type, path length, and line association. Passenger-related incidents contributed disproportionately to network performance degradation due to their unpredictability and prolonged impact. Additionally, we propose a new vulnerability index based on network efficiency, incorporating incident probabilities, travel cost increases, and ridership loss. This approach provides a more realistic and holistic assessment of station vulnerability by considering dynamic operational conditions and passenger flow. The proposed method identifies high-ridership stations and those with aging infrastructure, particularly along Line 1, as the most vulnerable due to their critical roles in maintaining network connectivity and susceptibility to incidents. These results offer valuable insights for transit authorities, emphasizing the need for targeted infrastructure upgrades at critical stations and strategies to mitigate passenger-related incidents as a source of prolonged delay in the network. </p>