2024 TfL hack affected around 10 million people, BBC can reveal

Around 10 million people had their data stolen when Transport for London (TfL) was hacked in 2024, the BBC has discovered, making it one of the biggest hacks in British history. At the time the company only disclosed that "some" customers had been affected, but has now confirmed that millions of people had their personal data taken. The cyber-attack, by hackers from the so-called Scattered Spider crime group, breached TfL's internal computer systems, disrupting its online services and causing £39m in damages. The hackers downloaded a database containing customer information - and by seeing a copy of the file BBC News has established the scale of the hack. TfL insisted to the BBC it has "kept customers informed throughout this incident and will continue to take all necessary action". The attack, which took place between late August and early September 2024, did not directly impact London transport but saw many TfL online services and information boards go offline. The trial of two British teenagers accused of carrying out the hack is set to begin in June. The BBC was contacted by someone in the hacking community who obtained a copy of the full TfL database. It contains names, email