TfL cyberattack: 10 million personal data records possibly compromised

Transport for London (TfL) has confirmed that approximately 10 million individuals may have had their personal information stolen during a significant cyberattack in 2024. This revelation comes after initial reports suggested a smaller scale of the breach, with further coverage provided by Tech Radar.

The cyberattack, which occurred in August 2024, reportedly saw the theft of names, email addresses, home and mobile phone numbers, and physical addresses. While TfL initially stated only "some" customers were affected, a database containing nearly 15 million lines of data, albeit with duplicates, has surfaced. The breach caused disruption to TfL systems and incurred an estimated £39 million in damages.

Although TfL has been cleared of wrongdoing by the Information Commissioner's Office, the scale of the data compromised is far greater than initially communicated, with only 7,113,429 customers with registered email addresses being alerted, and a low open rate for these notifications.

Source: Tech Radar