TfL updates customer data theft statement following cyber-attack

TLDR:

• Transport for London (TfL) has revised its statement on the customer data theft after a cyber-attack.
• The cyber-attack has disrupted online services, but core transportation networks remain unaffected.

Transport for London (TfL) has retracted its previous claim that there is no evidence of customer data being compromised in the ongoing cyber-attack. The incident, which began over a week ago, has disrupted several TfL online and digital services while leaving the core transportation network unaffected. TfL acknowledged that the incident remains ongoing and that security of its systems and customer data is a top priority. Despite not releasing additional information regarding the nature of the cyberattack or steps being taken to address it, TfL has sought assistance from the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA). The attack has impacted various services like Oyster photocard applications, limited access to journey history for contactless pay-as-you-go users, and delays in customer service responses. Despite the challenges, London’s transport network continues to operate with minimal disruption. The nature of the attack remains unclear, but reports suggest it targeted TfL’s backroom systems. This incident comes just over a year after a previous breach in July 2023.