Transport For London Dealing With ‘Ongoing’ Cyber-Attack

Matthew Broersma,
Linkedin
Tube train operated by Transport for London. Image credit: TfL

Transport for London hit by ‘ongoing’ cyber-attack, but customer data and transport services ‘not affected’

Transport for London (TfL) said it has taken action to deal with an “ongoing” cyber-attack, but that the incident has not affected transport services and does not appear to have involved any compromise of customer data.

The organisation, which operates most of the capital’s transport services, said it was working closely with relevant government agencies including the National Crime Agency and the National Cyber Security Centre to assess and respond to the incident.

“We have introduced a number of measures to our internal systems to deal with an ongoing cybersecurity incident,” said TfL chief technology officer Shashi Verma in a statement.

“The security of our systems and customer data is very important to us and we will continue to assess the situation throughout and after the incident.

Computer code on a screen with a skull representing a computer virus / malware attack.

Back-end systems

“Although we’ll need to complete our full assessment, at present there is currently no evidence that any customer data has been compromised.

“There is currently no impact to TfL services and we are working closely with the National Crime Agency and the National Cyber Security Centre to respond to the incident.”

Verma did not specify the nature of the attack.

“We are working with Transport for London, alongside law enforcement partners, to fully understand the impact of an incident,” an NCSC spokesperson said.

The NCA said it was “aware” of a cyber incident involving TfL and was working closely with the NCSC and TfL to respond.

“The investigation is ongoing, and we are unable to comment further,” the NCA said.

The BBC reported that staff had been asked to work from home if possible, and said the incident had mainly affected TfL’s back-end systems at its corporate headquarters.

Andrew Lintell, general manager EMEA of cybersecurity firm Claroty, said that TfL’s size invites scrutiny from potential attackers and that such organisations operate cyber-physical systems that must be continuously monitored.

“Like any large, complex organisation, TfL must be mindful of the gap in its cyber hygiene standards,” Lintell said.

NHS attack

The event follows a ransomware attack in June on private pathology and diagnostic services provider Synnovis that affected NHS hospitals’ ability to match blood.

As a result, multiple London hospitals declared a critical incident, cancelled more than 10,000 operations and tests and were unable to carry out blood transfusions.

Russian criminal gang Qilin was behind the attack, former National Cyber Security Centre (NCSC) chief Ciaran Martin said.

Synnovis said at the time it had to cancel testing for 20,000 blood samples across 13,500 patients.

Qilin later shared nearly 400GB of data, including patient names, dates of birth, NHS numbers and descriptions of blood tests, on its dark web presence and Telegram channel.