Stories

Fri, 06 Mar 2026

Fri, 06 Mar 2026 TfL hack in 2024 affected around 10 million people, BBC can reveal

TfL insists it has "kept customers informed throughout this incident and will continue to take all necessary action".
Around 10 million people had their personal data stolen in a massive hack of Transport for London's (TfL) systems in 2024, making it one of the biggest hacks in British history. Initially, TfL only revealed that "some" customers were affected, but now admits that millions of individuals' information was compromised. The cyber-attack by hackers from the Scattered Spider crime group breached TfL's internal computer systems, causing £39m in damages and disrupting online services. The stolen database contains sensitive details such as names, email addresses, home phone numbers, mobile phone numbers, and physical addresses of an estimated 10 million people. A copy of the file was obtained by the BBC, which verified the scale of the hack. TfL insisted it had kept customers informed throughout the incident but refused to give a precise figure for how many people were affected. Emails sent to 7.1 million customers with registered email addresses notified them of the breach, but a 58% open rate suggests millions of people impacted did not receive or read the notification. The risk to individuals remains low, but being a victim of a data breach increases the likelihood of being targeted in scams and fraud attacks. TfL has been criticized for not publicly disclosing the full extent of the breach, with experts arguing that transparency is essential in fighting cyber-crime. Companies are not legally required to reveal the total number affected by breaches in the UK, although some do so voluntarily. The Information Commissioner's Office (ICO) cleared TfL of any wrongdoing and ruled no further action was needed after investigating the incident. The hack has sparked calls for changes in UK regulation or law to help victims of data theft and ensure transparency about the scale of breaches.