Transport for London confirms ‘cyber security incident’

Transport for London (TfL), a government organization responsible for road and public transport in the London metropolitan area, has disclosed it’s been hit by a cyberattack.

“We are currently dealing with an ongoing cyber security incident. At present, there is no evidence that any customer data has been compromised and there has been no impact on TfL services,” the transportation company says in a statement on its website.

In order to protect its corporate network and customer data, TfL has taken immediate action to prevent any further access to its systems. What kind of technical and organizational measures the company implemented, remains unclear.

TfL says on X, formerly known as Twitter, that it’s currently working on a solution to remedy the situation. “We need to complete our full assessment, but there is currently no evidence that any customer data has been compromised, or impact on TfL services,” the company says.

Furthermore, TfL states that it’s working closely with relevant government agencies to respond to the incident, including the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC).

Insiders have told the BBC employees have been asked to work at home if possible. Although TfL doesn’t want to reveal too much about the cyber security incident, inside sources say that the transport provider’s backroom systems at the corporate headquarters are primarily affected.

TfL’s Chief Technology Officer (CTO) Shashi Verma states that the company has introduced “a number of measures” to its internal systems to deal with the ongoing cyber security incident.

A NCSC spokesperson said to The Guardian: “We are working with Transport for London, alongside law enforcement partners, to fully understand the impact of an incident.”

Last July, a TfL supplier got hit with a cyberattack by the Russian ransomware operation Cl0p. The attackers used a vulnerability in MOVEit File Transfer software to gain access to its systems. Once in, they exfiltrated personal details of 13,000 customers.

“TfL takes cyber security very seriously and works closely with suppliers to ensure adequate protective measures are in place. This includes evaluating new suppliers and monitoring the performance of existing suppliers for data security robustness,” the company said at the time.