London Transport Hit By A Cyber Attack

Transport for London's (TfL) the local government body responsible for managing the transportation system in Greater London computer systems have been targeted in an on-going cyber attack and TfL has engaged with the UK government for a response.

According to TfL It said there was no evidence customer data had been compromised and there was currently no impact on TfL services and they are working with the National Crime Agency and the National Cyber Security Centre in response to the incident.

Employees have been asked to work at home, as the TfL IT systems at the corporate headquarters that are mainly affected. TfL’s chief technology officer Shashi Verma said: “We have introduced a number of measures to our internal systems to deal with an ongoing cyber security incident.... The security of our systems and customer data is very important to us and we will continue to assess the situation throughout and after the incident. 

The majority of cyber attacks typically involve hackers stealing sensitive data, and then either demanding a payment in exchange for deleting it, or selling it on the black market. So far, no evidence has emerged of TfL data being lost or stolen. "Although we’ll need to complete our full assessment, at present there is currently no evidence that any customer data has been compromised”, Verma said.

“The cyberattack on the Transport for London (TfL) marks a significant incident for an organization that millions of passengers rely on daily for its services. At this time, TfL does not believe its customer database has been compromised and says transport systems are not affected; however, the attack underscores the high-risk status of critical infrastructure in the UK, closely following this year’s cyberattack on the NHS which disrupted hospital operations and patient care.  
 
Threat actors can sit dormant in systems for extended periods of time and strategically plan to maximize the damage caused. While it’s not yet known when the TfL breach was initiated, the attack demonstrates the crucial need to detect and respond to unfolding cyberattacks as quickly as possible to minimize the impact of the incident. In this case, a successful attack on TfL has the potential to expose highly sensitive customer data as well as cause staffing shortages in critical industries, economic losses, and widespread commuter chaos. 
 
As cyberattacks on critical infrastructure increase in frequency and sophistication, it is vital that organizations make cybersecurity a top priority.

Kev Eley, Vice President UKI at Exabeam commented, "Critical infrastructure providers need to deploy a multifaceted cybersecurity strategy that prioritizes employee education and the continuous monitoring of anomalous behavior in both user and device activity. Organizations must build awareness around where their vulnerabilities lie, e.g. out of date patches or unsecure third-party suppliers, and ensure the basics of cybersecurity are being performed, including regular data-back-ups and following password hygiene best practice to form a well-rounded security foundation.”  

Joseph Carson, CISO at Delinea commented “While there have been no reported consequences to the public services and in an email to customers late Monday evening indicated that security is a top priority, so far no evidence of any customer data being compromised ... there is always the possibility of a more severe outcome once the incident response analyses the digital evidence...

"The reliability of public services is of the highest importance to the efficiency and productivity of our society and attacks like this can have far reaching consequences...

"The attempt is a reminder to consistently assess cyber risks with an aim to understand the IT ecosystem and lower the potential threat of cyber incidents. Visibility into who is accessing systems and the privileges they have can be make or break in critical systems and services” Carson said.

Right now, it is unclear who might be behind the attack, although TfL was previously targeted by Russian hackers last year as part of a wider attack that resulted personal information about employees being stolen.

TfL   |   BBC   |    Computer Weekly   |   Techradar   |   Chester Standard   |   ITPro   |   Computing   |   Standard

Image: @TfL 

You Might Also Read: 

London Hospitals Held To Ransom:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« AI & Biometrics In Cybersecurity
Bolster Security Using Dark Web Intelligence »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Echelon

Echelon

Echelon Company is a provider of information security services specializing in certification of security software and hardware products in Russia.

AVR International

AVR International

AVR educate, advise, analyse and provide professional, technical consultancy and support to ensure your business is safe, compliant and protected.

Zanasi & Partners

Zanasi & Partners

Zanasi & Partners is a security research and advisory company active in the EU and MENA areas. Services focus on technology solutions.

Cyber Risk Opportunities

Cyber Risk Opportunities

Cyber Risk Opportunities was formed to enable middle-market executives to become more proficient cyber risk managers so their organizations can thrive.

Xage Security

Xage Security

Xage is the world’s first blockchain-protected security platform for Industrial IoT.

MER Group

MER Group

MER Group is a world-leading solutions provider specializing in Homeland Security (HLS), Cyber and Intelligence, Communication Infrastructure and Tactical Communication Systems.

C2A Security

C2A Security

C2A Security offers a comprehensive suite of cyber security solutions for the automotive industry, providing in-vehicle end-to-end protection.

Optra Security

Optra Security

Optra Security specializes in information security with a focus on Application Security.

NSA Career Development Programs

NSA Career Development Programs

NSA offers entry-level programs to help employees enhance their skills, improve their understanding of a specific discipline and even cross-train into a new career field.

Information & Communications Technology Association of Jordan (int@j)

Information & Communications Technology Association of Jordan (int@j)

The Information & Communications Technology Association of Jordan is a membership based ICT and IT Enabled Services (ITES) industry advocacy, support and networking association.

Reflectiz

Reflectiz

Reflectiz empowers digital businesses to make all web applications safer by non-intrusively mitigating any website risks without a single line of code.

Arqit Quantum

Arqit Quantum

Arqit's mission is to use transformational quantum encryption technology to keep safe the data of our governments, enterprises and citizens.

SK Shieldus

SK Shieldus

SK shieldus are a converged security provider with business capabilities in both cybersecurity and physical security based on Big-Tech.

LimaCharlie

LimaCharlie

LimaCharlie gives security teams full control over how they manage their security infrastructure. Get full visibility, build what you want, control your data, get the security capabilities you need.

Auriga

Auriga

Auriga create innovative software and have become a benchmark for high quality banking software including cyber security solutions to protect business critical devices.

appNovi

appNovi

appNovi inventories everything to map the attack surface, identify missing security agents, and prioritize vulnerabilities based on exposure.