Cyber security incident

Keep up to date on the latest investigations into the cyber security incident and our response.

We are conducting a thorough investigation into the incident, alongside the National Crime Agency and the National Cyber Security Centre.

Our investigations identified that certain customer data was accessed and we have notified the Information Commissioner's Office of that. This included names and contact details for some customers, along with email addresses and home addresses where provided.

Some Oyster card refund data was accessed. This included bank account numbers and sort codes for a limited number of customers (around 5,000).

If your bank account number and sort code was affected, we have contacted you directly as a precautionary measure, to offer you support and guidance.

If you are contacted by someone claiming to have your data, you should contact Action Fraud, the UK's national reporting centre for fraud and cybercrime, on 0300 123 2040.

The National Cyber Security Centre has further guidance for individuals and families on data breaches.

We will continue to keep you updated.

Find out more about the progress we have made to restore our systems.

Last reviewed 26 November 2024.