UK NCA arrested a teenager linked to the attack on Transport for London

U.K. police arrested a 17-year-old teenager allegedly linked to the cyberattack on London’s public transportation agency, Transport for London.

U.K.’s National Crime Agency announced the arrest of a 17-year-old teenager from Walsall who is allegedly linked to the cyberattack that recently hit Transport for London.

“The 17-year-old male was detained on suspicion of Computer Misuse Act offences in relation to the attack, which was launched on TfL on 1 September.” states the UK National Crime Agency. “The NCA is leading the law enforcement response, working closely with the National Cyber Security Centre and TfL to manage the incident and minimise any risks.”

Transport for London (TfL) is a local government body responsible for most of the transport network in London, United Kingdom.

The attack on Transport for London (TfL) took place on September 1 and the transportation agency is still investigating the cyberattack.

The NCA arrested the teenager on 5 September. NCA officers questioned him before they released him on bail.

“We have been working at pace to support Transport for London following a cyber attack on their network, and to identify the criminal actors responsible.” said Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit. “The swift response by TfL following the incident has enabled us to act quickly, and we are grateful for their continued co-operation with our investigation, which remains ongoing.” 

Deputy Director Paul Foster remarked that cyber attacks on public infrastructure can cause significant disruptions and could severely impact the citizens.

“The NCA leads the UK’s response to cybercrime. We work closely with partners to protect the public by ensuring cyber criminals cannot act with impunity, whether that be by bringing them before the courts or through other disruptive and preventative action.” added Foster.

Initially, TfL announced that customer data was not stolen, however, the agency today disclosed a data breach. Threat actors had access to customer data, including customers’ names, contact details, email addresses, and home addresses.

“Although there has been very little impact on our customers so far, the situation is evolving and our investigations have identified that certain customer data has been accessed. This includes some customer names and contact details, including email addresses and home addresses where provided.” reads an update provided by the agency. “Some Oyster card refund data may have been accessed. This could include bank account numbers and sort codes for a limited number of customers (around 5,000).”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)