Tf L admits 2024 cyberattack may have affected over 10 million people — personal customer info stolen, here's what we know so far | Tech Radar

Overview

Tf L admits 2024 cyberattack may have affected over 10 million people — personal customer info stolen, here's what we know so far

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Details

Tf L reportedly admits scale of 2024 cyberattack was much greater than first thought

Around 10 million people may have had personal information stolen

Names, email addresses, home phone numbers, mobile phone numbers and physical addresses all stolen

Transport for London (Tf L) has confirmed around 10 million people had their data stolen in a 2024 cyberattack, new reports have claimed.

The BBC has reported the figures after reportedly seeing a copy of a database stolen by hacking group Scatted Spider, containing names, email addresses, home phone numbers, mobile phone numbers and physical addresses.

The attack in August 2024 caused major disruption to Tf L systems, with online services and information boards all affected, and an estimated £39m in damages.

Aflac reveals personal data of 22.6 million people stolen in cyberattack - here's what we know

Eurail confirms stolen traveler data is on sale in the dark web - and it still doesn't know who is behind the attack

Conduent data breach might have been much worse than initially expected

Tf L initially said that only "some" customers were affected, and told the BBC it "kept customers informed throughout this incident and will continue to take all necessary action".

It noted a full investigation had been carried out, but didn't precisely say how many people had been affected - until now, admitting that 7,113,429 customers with an email address registered to their Tf L account had been alerted.

However these emails only had a 58% open rate - meaning potentially millions of affected people have not read the statutory notification, and those who did not have an active email registered with Tf L may still be unaware criminals may have their data.

The BBC noted the database had nearly 15 million lines of data in total, but many of these look to be duplicates.

Tf L has been cleared by the Information Commissioner's Office (ICO), the UK's data watchdog, of any wrongdoing for the breach and its handling of the aftermath, but admitted at the time of the incident, only around 5,000 users were contacted, due to their Oyster card refund data possibly being accessed, meaning bank account numbers and sort codes might have been affected.

Tf L admitted in December 2024 it had to spend around £30 million (roughly $38 million) on addressing the attack, including “external support” - third-party cybersecurity organizations that help respond and remedy the attack.

Two British teenagers accused of carrying out the hack are set to go on trial in June 2026.

Major telco breach sees 6.2 million users have personal info leaked - here's what we know so far

Soundcloud confirms data breach - user info stolen, here's what you need to know

Major health provider data breach may have affected thousands more people - over 700k now thought to have been hit

“The most surprising part of the Tf L breach isn’t that millions of people had their data stolen, it’s that the true scale of it only really becomes clear long after the incident occurs," noted Jake Moore, Global Cybersecurity Advisor at ESET.

"Ten million records is an incredibly valuable dataset for criminals and when joined up to further previously exposed data, it becomes a treasure trove that is never deleted. Even if the data hasn’t being actively abused yet, it’s highly likely that it will be traded and reused in scams for years."

"When millions of ordinary people rely on a service like this every day, the impact goes far beyond the organisation itself which is why immediate transparency around the scale of a cyberattack is so important. Anyone who had payment details linked to a Tf L account should therefore continue to keep a close eye on their bank statements and remain cautious of any unexpected messages.”

➡️ Read our full guide to the best antivirus

1. Best overall: Bitdefender Total Security
2. Best for families: Norton 360 with Life Lock
3. Best for mobile: Mc Afee Mobile Security

Follow Tech Radar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow Tech Radar on Tik Tok for news, reviews, unboxings in video form, and get regular updates from us on Whats App too.

Mike Moore is Deputy Editor at Tech Radar Pro. He has worked as a B2B and B2C tech journalist for nearly a decade, including at one of the UK's leading national newspapers and fellow Future title ITPro Portal, and when he's not keeping track of all the latest enterprise and workplace trends, can most likely be found watching, following or taking part in some kind of sport.

You must confirm your public display name before commenting

1 How to master AI prompts to create the image you need the first time

2 What is the release date for Marshals: A Yellowstone Story episode 2 on Paramount+?

3 This $9 fix is a great way to watch the Australian GP even if you're on the move — here's what you need to know

4I've spent 40 hours cracking skulls and casting spells from behind Avowed's Quarterstaff, and Obsidian's action role-playing game is better than ever on Play Station 5

5I am not sure what features I prefer on the WP500 Ultra: 1TB storage, a privacy kill switch, or the ubercool Predator-style thermal imaging vision

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

© Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.

Key Takeaways

• Tf L admits 2024 cyberattack may have affected over 10 million people — personal customer info stolen, here's what we know so far

• When you purchase through links on our site, we may earn an affiliate commission

• Tf L reportedly admits scale of 2024 cyberattack was much greater than first thought

• Around 10 million people may have had personal information stolen

• Names, email addresses, home phone numbers, mobile phone numbers and physical addresses all stolen