Plans


to
extend
pay-as-you-go
contactless
ticketing
to
another
47
stations
in
south
east
England
on
22
September
have
been
delayed
because
of
the
cyber
attack
on
computer
systems
at
Transport
for
London.

TfL
has
also
disclosed
that
financial
and
other
data
about
its
customers
could
have
been
obtained
by
the
attackers,
and
that
some
services
may
be
disrupted.

Chief
technology
officer
Shashi
Verma
said:
‘The
security
of
our
systems
and
customer
data
is
very
important
to
us.
We
continually
monitor
who
is
accessing
our
systems
to
ensure
only
those
authorised
can
gain
access. 
We
identified
some
suspicious
activity
on
Sunday
1
September
and
took
action
to
limit
access.
A
thorough
investigation
continues
alongside
the
National
Crime
Agency
and
the
National
Cyber
Security
Centre.

‘Although
there
has
been
very
little
impact
on
our
customers
so
far,
the
situation
continues
to
evolve
and
our
investigations
have
identified
that
certain
customer
data
has
been
accessed.
This
includes
some
customer
names
and
contact
details,
including
email
addresses
and
home
addresses
where
provided.

‘Some
Oyster
card
refund
data
may
also
have
been
accessed.
This
could
include
bank
account
numbers
and
sort
codes
for
a
limited
number
of
customers.
As
a
precautionary
measure,
we
will
be
contacting
these
customers
directly
as
soon
as
possible
to
advise
them
of
the
support
we
can
provide
and
the
steps
they
can
take.

‘We
have
notified
the
Information
Commissioner’s
Office
and
are
working
with
our
partners
to
progress
the
investigation.
We
will
provide
further
updates
as
soon
as
possible.

‘In
addition,
as
part
of
the
measures
we
have
implemented
to
deal
with
the
cyber
incident,
we
have
today
put
in
place
additional
measures
to
improve
our
security.
This
includes
an
all-staff
IT
identity
check.
Throughout
this
planned
process
we
have
ensured
that
all
safety
critical
systems
and
processes
have
been
maintained.

‘We
do
not
expect
any
significant
impact
to
customer
journeys
as
we
carry
out
this
process.
However,
temporary
and
limited
disruption
is
possible
to
some
services
so,
as
ever,
please
check
before
you
travel.’

‘The
security
measures
we
are
taking
mean
that
it
is
now
not
possible
for
us
to
deliver
the
necessary
system
changes
to
enable
47
additional
stations
outside
London
to
benefit
from
pay
as
you
go
with
contactless
on
22
September
as
planned.
We
are
working
with
DfT
and
the
Rail
Delivery
Group
to
reschedule
and
we
apologise
for
the
delay.

‘We
will
continue
to
keep
our
customers
and
our
staff
updated.
I
would
like
to
apologise
for
the
inconvenience
this
incident
may
cause
customers
and
I
thank
everyone
for
their
patience
as
we
respond
to
this
incident.’