TfL is in the process of contacting around 5,000 customers amid concern that their email and bank account details may have been compromised in a cyber security incident which has affected the organisation’s systems this month.

TfL said that some customer names and contact details – including email and home addresses – were accessed. It added that some Oyster card refund data may also have involved in the breach, potentially including bank account numbers and sort codes for a limited number of customers, who will be contacted individually about the incident.

A teenager has been arrested in Walsall by the National Crime Agency, as part of the investigation into the incident. The 17-year-old male was detained on suspicion of Computer Misuse Act offences in relation to the attack, which was launched on TfL on 1 September.

The teenager, who was arrested on 5 September, was questioned by NCA officers and bailed. Deputy Director Paul Foster, head of the NCA’s national cybercrime unit, said: “We have been working at pace to support Transport for London following a cyber attack on their network, and to identify the criminal actors responsible. Attacks on public infrastructure such as this can be hugely disruptive and lead to severe consequences for local communities and national systems.

“The swift response by TfL following the incident has enabled us to act quickly, and we are grateful for their continued co-operation with our investigation, which remains ongoing.”
The incident has led to the delay of a project to rollout contactless payments to 47 railway stations across south-east England which was due to allow commuters to travel ticket-free into the Capital from 22 September.

Shashi Verma, TfL's chief technology officer, said: “The security measures we are taking mean that it is now not possible for us to deliver the necessary system changes to enable 47 additional stations outside London to benefit from pay as you go with contactless on 22 September as planned. We are working with DfT and the Rail Delivery Group to reschedule and we apologise for the delay.”

---