BBC says TfL hack in 2024 affected around 10 million

The BBC has revealed that around 10 million people had their data stolen during the 2024 hack of Transport for London (TfL), making it one of the largest cyberattacks in British history.

At the time, the company said only that “some” customers had been affected. It has now confirmed that millions of people had their personal data stolen.

The cyberattack, carried out by hackers linked to the Scattered Spider crime group, breached TfL’s internal computer systems, disrupting its online services and causing £39 million in damage.

The attackers downloaded a database containing customer information, and after reviewing a copy of the file, BBC News has been able to determine the true scale of the breach.

The trial of two British teenagers accused of carrying out the hack is set to begin in June.

The BBC was contacted by an individual from the hacking community who had obtained a complete copy of the TfL database.

The file contains the names, email addresses, home and mobile phone numbers, and physical addresses of an estimated 10 million people.

The individual, who remained anonymous, shared the database with the BBC so it could verify the information.

After reviewing the file— which has since been deleted— the BBC found it contained millions of rows of names and personal details.

In total, the dataset includes nearly 15 million entries, although some are believed to be duplicates.