Transport for London Penetrated Over Three Days in August 2024

Transport for London’s network was entered between 31 August and 3 September 2024, with suspicious activity identified on 1 September. TfL wrote to around 5,000 customers whose bank account numbers and sort codes may have been accessed, drawn from its Oyster refund system.

Reported loss and recovery costs were about £29m. Oyster photocard applications for children and young people were suspended, and contactless refunds stopped.

It is four orders of magnitude below the largest 2024 files. If severity were assigned by affected population, this would barely register.

The £29m is not a small number, and neither is a suspended service that families use to get children to school. This corpus argues that availability harm goes uncounted; TfL is the case where the availability cost is documented and the confidentiality count is the footnote.

Those later convicted were described as members of the Scattered Spider collective — the loose grouping behind the identity-led intrusions this database records across the identity theme, in which a phone call replaces an exploit.

A public transport authority sits alongside retailers, casinos and insurers in that pattern. The technique does not select by sector; it selects by whoever restores access to accounts.

A retailer that loses a fortnight loses margin. A transport authority that suspends concessionary travel applications imposes the cost on children and their families, who have no alternative supplier and no compensation route.

The corpus files that under funding: the parties who could fix the problem are not the parties who pay for it. Here the parties who pay could not have influenced the outcome at all.