LONDON: Around 10 million people had their data stolen in a cyberattack on London's public transport operator in 2024, making it one of Britain's largest breaches, the BBC reported on Friday.
Transport for London said it had sent an email to more than seven million customers in September 2024 "to inform them about the incident and that some customer data may have been taken".
"These were the customers we had email addresses for based on the data which was understood to have been taken," TfL said in a statement on Friday.
The BBC said it had concluded 10 million were affected after reviewing data from an anonymous source who had obtained a copy of the full TfL database.
The attack, which took place between August 29 and September 6 2024, did not affect transport on its networks but caused three months of disruption to TfL's online services, costing the company tens of millions of pounds.
TfL previously said that some customer names and contact details had been compromised in the attack, which was discovered on September 1 2024.
Around 5,000 customers were contacted because some of their refund data, including bank account details, may have been accessed, a TfL spokesperson said on Friday.
Investigators believe the cyberattack was carried out by an online criminal collective known as Scattered Spider.
Two British teenagers were charged last year with carrying out the attack and are due to stand trial in June.
Cyber gangs have increasingly targeted UK brands and retailers this year, with attacks on retail chains including Marks & Spencer and the Co-op, as well as on carmaker Jaguar Land Rover. – AFP
