INCIDENT REPORT · CP-2024-010

Transport for London cyber incident

L2 · GUARDEDCONFIRMED

Transport for London found suspicious activity on its systems on 1 September 2024. The incident disrupted back-office and customer-facing digital services, and customer data was accessed.

Incident ID: CP-2024-010
Incident date: 01 SEP 2024
Detection date: 01 SEP 2024
Affected countries: United Kingdom
Plotted location: London, United Kingdom (Affected organization headquarters)
Threat classification: Level 2 — GUARDED
Classification rationale: Significant data and digital-service impact at a major transport authority, but transport operations continued.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Transportation, Government
Critical infrastructure: Yes
Organizations affected: Transport for London (TfL)
Operational consequences: TfL contacted about 5,000 customers whose bank account details may have been accessed, and some online services were restricted for months. TfL said the attack caused about £39 million in damage and disruption over three months.
Estimated financial impact: TfL stated a cost of about £39 million (reported in coverage of the September 2025 charges); no USD figure was stated.
Attribution (as stated): Attributed by the UK National Crime Agency, which in September 2025 charged two UK men (Thalha Jubair and Owen Flowers) under the Computer Misuse Act; media reports link them to Scattered Spider

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Transport for London cyber incident

L2 · GUARDEDCONFIRMED

Transport for London found suspicious activity on its systems on 1 September 2024. The incident disrupted back-office and customer-facing digital services, and customer data was accessed.

Incident ID

CP-2024-010

Incident date

01 SEP 2024

Detection date

01 SEP 2024

Affected countries

United Kingdom

Plotted location

London, United Kingdom (Affected organization headquarters)

Threat classification

Level 2 — GUARDED

Classification rationale

Significant data and digital-service impact at a major transport authority, but transport operations continued.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Transportation, Government

Critical infrastructure

Yes

Organizations affected

Transport for London (TfL)

Operational consequences

TfL contacted about 5,000 customers whose bank account details may have been accessed, and some online services were restricted for months. TfL said the attack caused about £39 million in damage and disruption over three months.

Estimated financial impact

TfL stated a cost of about £39 million (reported in coverage of the September 2025 charges); no USD figure was stated.

Attribution (as stated)

Attributed by the UK National Crime Agency, which in September 2025 charged two UK men (Thalha Jubair and Owen Flowers) under the Computer Misuse Act; media reports link them to Scattered Spider