A 17-year-old male has been arrested in connection with a cyber attack on Transport for London (TfL), which compromised the personal data of thousands of customers. The teenager was detained in Walsall on suspicion of offences under the Computer Misuse Act, following the cyber security incident that began on 1 September 2024.

TfL has confirmed that certain customer data, including names, contact details, email addresses, and home addresses, was accessed during the attack. Additionally, data related to Oyster card refunds, including bank account numbers and sort codes for approximately 5,000 customers, may also have been compromised.

Paul Foster, head of the National Cyber Crime Unit (NCA), said: “We have been working at pace to support Transport for London following a cyber attack on their network, and to identify the criminal actors responsible. Attacks on public infrastructure such as this can be hugely disruptive and lead to severe consequences for local communities and national systems.

He praised the swift action taken by TfL, which enabled investigators to respond quickly to the incident: “The NCA leads the UK’s response to cybercrime. We work closely with partners to protect the public by ensuring cyber criminals cannot act with impunity, whether that be by bringing them before the courts or through other disruptive and preventative action.”

TfL, in a statement on Thursday, provided an update to customers regarding the ongoing investigation: “Although there has been very little impact on our customers so far, the situation is evolving and our investigations have identified that certain customer data has been accessed.”

TfL has reassured customers that anyone affected will be contacted directly and provided with support and guidance.

The investigation remains ongoing as authorities continue to assess the full extent of the breach and work to safeguard TfL’s systems from future attacks.