Transport for London said the sensitive personal information of its customers was compromised during a data security incident involving its IT systems earlier this month.
Tfl said earlier this month that it was “dealing with an ongoing cyber security incident” but assured riders that none of its essential operations were compromised or disrupted.
The transportation service said it worked with relevant law enforcement authorities, including the National Crime Agency and the National Cyber Security Centre, to respond to the incident.
The transportation service initially said that “there is no evidence that any customer data has been compromised”, but in a recent update, it said that investigation has revealed that certain sensitive personal data of its customers were accessed during the security incident.
The compromised data included “names and contact details, including email addresses and home addresses where provided.”
“Some Oyster card refund data may have been accessed. This could include bank account numbers and sort codes for a limited number of customers (around 5,000),” Tfl said.
TfL added that certain operations are still unavailable, including Live Tube arrival information on certain digital channels, including TfL Go and the TfL website.
Applications for new Oyster photocards, including Zip cards, are temporarily suspended. Customers who are travelling using a contactless payment card won’t be able to access their online journey history.
“Currently we are unable to issue refunds for incomplete pay as you go journeys made using contactless, so always remember to touch in and out. Oyster customers can self-serve online. Many of our staff have limited access to systems and, as a result, there will be some delays responding to any online enquiries,” the company added.
Tfl said it will notify all affected individuals whose data was compromised during the incident and will provide guidance on how to deal with the situation.
