(Commonwealth_UK) WiFi services at several prominent train stations across the UK have been suspended following a significant cybersecurity incident. Nineteen stations, including London Euston, Manchester Piccadilly, and Birmingham New Street, experienced disruptions on Wednesday night, with services remaining offline on Thursday.
According to the *Manchester Evening News*, passengers attempting to connect to the Wi-Fi at Piccadilly Station were redirected to a webpage titled “We Love You, Europe,” which contained Islamophobic content alongside references to various terrorist attacks that have occurred in the UK and Europe. A spokesperson for Network Rail confirmed that the incident had impacted the public Wi-Fi services at stations under their management. This facility is provided via a third party and has been suspended while an inquiry is ongoing, they stated.
The British Transport Police (BTP) acknowledged that they were informed of a cyberattack affecting some Network Rail Wi-Fi services around 5:03 PM on September 25. They are collaborating with Network Rail to investigate the matter thoroughly. Telent, the company responsible for providing Wi-Fi services to Network Rail, reported that an “unauthorized change” to the Wi-Fi landing page was made using a legitimate administrator account. This incident is now under criminal investigation. Telent emphasized that no personal data has been compromised and that they are currently working alongside Global Reach, the firm that supplied the landing page, to ascertain the full scope of the incident.
“As a precautionary measure, Telent has temporarily suspended all use of Global Reach services to ensure that no other customers are affected,” the company stated. On Thursday, the BTP announced the arrest of an individual employed by Global Reach under the Computer Misuse Act 1990 and the Malicious Communications Act 1988, further emphasizing the seriousness of the incident.
The following major London stations were affected: King’s Cross, London Bridge, Euston, Victoria, Cannon Street, Charing Cross, Liverpool Street, Clapham Junction, Waterloo, and Paddington. In addition to Manchester Piccadilly, other affected stations include Liverpool Lime Street, Birmingham New Street, Glasgow Central, Leeds City, Bristol Temple Meads, Edinburgh Waverley, Reading, and Guildford.
This incident follows a recent cyberattack on Transport for London (TfL), which raised concerns about potential breaches of thousands of customer details. While TfL operations continued as normal, the organization restricted access to live travel data used by various travel applications, including Citymapper and TfL Go, while they addressed the breach. The National Crime Agency (NCA) apprehended a 17-year-old male from Walsall under the Computer Misuse Act 1990 in connection with the TfL incident; he has since been released on bail.
TfL has begun notifying approximately 5,000 customers whose email and bank account details may have been compromised, particularly those who requested refunds for journeys made using Oyster cards. The organization has not provided a timeline for when access to passenger journeys and live travel data will be restored, but assured customers that their full journey history will be made available once services resume. This series of cybersecurity incidents highlights the increasing vulnerability of critical infrastructure to cyber threats and the imperative for robust security measures to protect public services and personal data.
