London’s transport operator confirms data leak in cyberattack
5,000 customers will be told their bank details may have been exposed
London’s transport operator has confirmed that some customer data was accessed during a cyberattack identified at the beginning of this month. Transport for London said some customer names, home addresses and email addresses were breached as well as some refund data, including bank account and sort codes, during the attack, which caused the operator of London’s trains, buses and underground to limit access to its systems.
In an update on the cyberattack, Transport for London’s chief technology officer Shashi Verma said only a limited number of customers are thought to have been affected by the breach but that it is contacting 5,000 customers directly regarding bank detail data.
It has also launched an IT identity check against all Transport for London staff. Further, it has delayed the planned rollout of its pay-as-you-go contactless payment system to an additional 47 stations as the new security measures go ahead.
“We identified some suspicious activity on Sunday 1 September and took action to limit access. A thorough investigation continues alongside the National Crime Agency and the National Cyber Security Centre,” Verma said, as the National Crime Agency announced the arrest of a 17 year old in connection with the cyberattack. Transport for London restricted access to its photocard portal – which allows customers to apply for travel concessions, including over 60s and under 18s – following the cyberattack, as well as limiting access to customers’ journey history for pay-as-you-go contactless customers.
Meanwhile, the impact of a cyberattack against pathology services provider Synnovis in June is still being felt by two London hospital trusts. NHS England London said three months on from the cyberattack, King’s College Hospital NHS Foundation Trust and Guy’s and St Thomas’ NHS Foundation trusts are still cancelling outpatient appointment and operations because of the attack, although the numbers are now small.
So far, 10,140 acute outpatient appointments and 1,704 elective procedures have been postponed across the two trusts, NHS England London said in its most recent update.
NHS London’s medical director Dr Chris Streather said it is working to fully restore blood transfusion services. Most GPs were due to transfer blood test services back to Synnovis at the end of last week with GPs, which will be extended to the one remaining affected borough at the end of September. Pathology testing for local community and mental health services will resume after that, Synnovis said.
Mark Dollar, CEO of Synnovis, said it has rebuilt the majority of its core IT systems but some processes are still being conducted manually.
“The impact the cyberattack is having on local healthcare services continues to subside, although regrettably we expect to feel its effects for some weeks to come,” Dollar said.
