Transport for London's Oyster card service remains unavailable two months post breach

Transport for London said its Oyster photocard service remains unavailable even though two months have transpired since it experienced a significant cyber attack.

 

In September, Tfl said that it was “dealing with an ongoing cyber security incident” but assured riders that none of its essential operations were compromised or disrupted.

 

The transportation service said it worked with relevant law enforcement authorities, including the National Crime Agency and the National Cyber Security Centre, to respond to the incident.

 

TfL initially said that “there is no evidence that any customer data has been compromised”, but in a later update, confirmed that certain sensitive personal data of its customers were accessed during the security incident.

 

The compromised data included “names and contact details, including email addresses and home addresses where provided.”

 

“Some Oyster card refund data may have been accessed. This could include bank account numbers and sort codes for a limited number of customers (around 5,000),” Tfl said.

 

In a recent update, Tfl said that Oyster photocards for children, students, care leavers, people aged over 60, apprentices and veterans are still unavailable and the transportation service provider can’t process new applications until further notice.

 

“New university students studying in London cannot apply for an 18+ Student Oyster photocard. Please keep a record of fares paid as it is our intention to refund customers for additional travel costs incurred while our Oyster photocard website is unavailable,” TfL said.

 

“Although we are currently unable to process Oyster photocard applications, we advise you start the application process by telling your responsible London borough that you’re interested in applying. If you’re eligible, they’ll share your data with us and as soon as our Oyster photocard website is back up and running you can then apply.

 

“Please keep a record of fares paid as it is our intention to refund customers for additional travel costs incurred while our Oyster photocard website is unavailable,” it added.

 

Tfl has clarified that citizens can request a refund for their photocard via an online form, however it will be processed once the data security incident is completely resolved.