TfL Required Every Employee to Attend in Person for a Password Reset

Following the intrusion, all 28,000 TfL employees were required to attend a TfL office in person to have their passwords reset and their identity verified.

It is the single most instructive operational detail in the 2024 files, and it is the exact inverse of how the intrusion happened.

The identity-led intrusion works by persuading whoever restores access that the caller is the employee. The corpus records it across dozens of files: no vulnerability is used, the system grants legitimate credentials to the wrong person, and everything downstream looks normal.

Once that has happened, an organisation cannot trust any remote assertion of identity — including the ones it would normally use to re-establish trust. A reset performed over the phone is exactly the mechanism it is trying to undo.

So the only remaining verifier is physical presence. That is why 28,000 people had to be in a room.

Twenty-eight thousand journeys, appointments, queues and hours away from the actual job, across an organisation that runs a city’s transport. None of it appears as a data-breach figure and most of it will not appear as a line item anywhere.

This corpus records the fallback theme as manual procedures inherited from a pre-automation era that nobody tracks. Here the fallback is the oldest one there is — look at the person — and it worked precisely because it has no technical component to compromise.

Almost no organisation knows how long it would take to physically verify its entire workforce, or whether it could. A distributed workforce, a contractor population, a night shift and a set of people on leave each make it harder.

The corpus asked at 24-0720 whether anybody tests time-to-touch-every-machine. This is the same question about people, and this desk has seen no evidence that anybody measures it either.