TfL suspends live travel data after cyberattack

Chiswick Park tube station – Photograph of the day by Ljubima Woods @ljubimawoods

Image: Chiswick Park Station; Photograph by Ljubima Woods

Cyberattack that began over a week ago still affecting services say Transport for London

Transport for London (TfL) has temporarily suspended access to live travel data and certain customer services following a significant cyberattack that began over a week ago.

While public transport services such as the London Underground and buses continue to operate as normal, the disruption has impacted real-time travel updates on popular travel apps like Citymapper and TfL Go, as well as the TfL website.

Among the affected services are live Tube departure times and traffic updates from TfL’s JamCams, which have been suspended. Despite these issues, platform information displays at Tube stations and bus countdown services remain fully operational, ensuring that commuters can still receive updates at physical locations.

In a statement, TfL confirmed that the cyberattack is still under investigation, but there is no indication that it involves ransomware. So far, no ransom demands have been made, and there is no evidence that customer data has been compromised.

“The security of our systems and customer data is very important to us. We continually monitor who is accessing our systems to ensure only those authorised can gain access,” Shashi Verma, TfL’s Chief Technology Officer, said.

TfL is working closely with the National Crime Agency and the National Cyber Security Centre to manage the breach. Both agencies confirmed their involvement adding that they are actively assisting TfL in addressing the incident. The full scope of the attack has yet to be determined.

In addition to the restrictions on live travel data, TfL has also suspended online applications for concessionary photocards, such as youth Zip cards and 60+ passes. Contactless payment system users are unable to access their journey history online for the time being, adding to the growing list of disrupted services.

Early last week, the booking system for Dial-a-Ride services was also temporarily unavailable, but essential bookings can now be made over the phone, with pre-existing appointments unaffected. TfL has assured passengers that they are working to restore full service as soon as possible.

The attack has had a direct impact on TfL’s corporate headquarters in Southwark, where many employees have been encouraged to work remotely. Although some staff remain in the office, the situation highlights the severity of the attack on TfL’s internal systems.

Despite the disruptions, Shashi Verma sought to reassure the public.

“We will continue to keep our customers and our staff updated on the incident as part of this ongoing work and thank them for their patience as we respond to this incident.” TfL has pledged to update passengers as the investigation progresses and aims to restore services as quickly as possible,” she said.