Article Details
Scrape Timestamp (UTC): 2024-09-12 15:00:46.295
Source: https://www.theregister.com/2024/09/12/transport_for_londons_cyber_attack/
Original Article Text
Click to Toggle View
Transport for London confirms 5,000 users' bank data exposed, pulls large chunks of IT infra offline. Hauling in 30,000 staff IN PERSON to do password resets. Breaking Transport for London's ongoing cyber incident has taken a dark turn as the organization confirmed that some data, including bank details, might have been accessed, and 30,000 employees' passwords will need to be reset via in-person appointments. TfL quietly dropped the claim it made earlier this week that there had been "no evidence" of customer data being compromised in its cyber incident page. A further update has now confirmed that, yes, some customer data might indeed have been accessed. According to TfL: "Some Oyster card refund data may have been accessed. This could include bank account numbers and sort codes for a limited number of customers (around 5,000)." TfL has said it will contact affected customers as soon as possible "as a precautionary measure." While the network continues to run, large chunks of the TfL IT infrastructure have been pulled offline. Live tube arrival information isn't available, applications for new Oyster photocards have been suspended, and refunds for incomplete pay-as-you-go journeys made using contactless. Staff have limited access to systems. The last point is significant since TfL is undertaking an all-staff identity check and resetting 30,000 employee passwords in person. According to the TfL Employee Hub, staff details have been accessed as well as those of customers, although right now TfL only suspects email addresses, job titles, and employee numbers have been looked at. The Register understands that the incident is very much ongoing and another attack was attempted. There has also been an emergency meeting for management regarding the situation and a change in the physical security stance around TfL offices and facilities. TfL is no stranger to identity theft and malware. In 2023, a London Underground worker, using a keylogger, was able to give himself discounts and access the accounts of colleagues. The worker, Lewis Kelly, narrowly avoided a custodial sentence at the time.
Daily Brief Summary
Transport for London (TfL) has acknowledged a cyber incident that potentially compromised customer bank data, including account numbers and sort codes of approximately 5,000 users.
Initially denying customer data compromise, TfL has now confirmed that some customer data "might indeed have been accessed," specifically mentioning Oyster card refund information.
As a response to the breach, TfL is undertaking a mass password reset, requiring 30,000 employees to reset their passwords in person due to accessed staff details including email addresses, job titles, and employee numbers.
Significant portions of TfL's IT infrastructure have been taken offline to manage the situation, impacting services like live tube arrival updates, and suspending applications for new Oyster photocards and contactless journey refunds.
TfL plans to contact affected customers as a precautionary measure and continues running its network despite the cyber incident.
Additional security measures and an emergency management meeting have been enacted in response to another attempted attack and to reassess physical security around TfL facilities.