TFL say data including bank details accessed in cyber attack after Walsall teenager arrested

TfL Underground sign
Transport for London have identified that certain customer data has been accessed. Credit: PA

Transport for London (TFL) say the ongoing cyber incident involves access to customer data, including 5000 bank account details.

It first recognised the suspicious activity on Sunday 1 September and took action to limit access to data.

The National Crime Agency and the National Cyber Security Centre have been working alongside TFL to tackle the problem and a 17-year-old boy from Walsall has been arrested.

The teenager was arrested on suspicion of Computer Misuse Act offences in relation to the attack, on 5 September and questioned by NCA officers before being bailed.

Transport for London dealing with ‘ongoing cyber security incident’

The investigation has since identified customer data was accessed including some customer names and contact details, including email addresses and home addresses.

But there was also Oyster card data accessed including bank account numbers and sort codes for around five thousand customers.

TFL say they'll contact anyone directly who has been affected with support and guidance.

They added whilst they protect services and secure systems and data there are proactive measures in place. These include:

  • Live Tube arrival information is not available on some of our digital channels, including TfL Go and the TfL website. In-station and journey planning information is still available

  • Applications for new Oyster photocards, including Zip cards, have been temporarily suspended.

  • If you have been unable to apply, please continue making your journeys as usual and keep a record of any fares paid. We may be able to arrange a refund once the incident has been resolved and you receive your new photocard

  • ⁠If you travel using a contactless payment card, you won’t be able to access your online journey history

  • Currently we are unable to issue refunds for incomplete pay as you go journeys made using contactless, so always remember to touch in and out. Oyster customers can self-serve online.

Staff also don't have full access to systems so there is a delay in responses to online enquiries too and a full IT identity check is taking place.

Want a quick and expert briefing on the biggest news stories? Listen to our latest podcasts to find out What You Need To Know...