• Posted by: RST
• September 14, 2024

17-Year-Old Arrested for TfL Cyber Attack Affecting 5,000 Customers

British authorities have arrested a 17-year-old male from Walsall in connection with a cyberattack on Transport for London (TfL) that occurred on September 1, 2024. The arrest, made on September 5, 2024, follows an investigation launched shortly after the breach was detected. The teenager was detained under suspicion of violating the Computer Misuse Act but was later released on bail.

In a statement, the U.K. National Crime Agency (NCA) revealed the ongoing nature of the investigation. "Attacks on public infrastructure such as this can be hugely disruptive and lead to severe consequences for local communities and national systems," said Paul Foster, Deputy Director of the NCA's National Cyber Crime Unit. "The swift response by TfL following the incident has enabled us to act quickly, and we are grateful for their continued cooperation."

TfL confirmed that the breach resulted in unauthorized access to bank account numbers and sort codes of approximately 5,000 customers. Although there has been limited impact so far, TfL is directly contacting affected customers. "Our investigations have identified that certain customer data has been accessed, including some customer names, contact details, and home addresses where provided," a TfL spokesperson said.

In response, TfL has required about 30,000 staff members to complete an IT identity check. Employees must attend an in-person appointment at a designated TfL location to reset their passwords and verify access to TfL systems.

This latest incident has raised concerns about a possible connection to a separate ransomware attack in July 2024, when West Midlands police arrested a 17-year-old boy, also from Walsall, for an attack on MGM Resorts. That incident was linked to the infamous Scattered Spider group, known for targeting organizations in the insurance and financial sectors, especially their cloud infrastructures.

Scattered Spider, also referred to as The Com, 0ktapus, Octo Tempest, or UNC3944, has gained notoriety for using social engineering techniques like voice phishing (vishing) and text message phishing (smishing). They often target IT service desks and identity administrators to gain unauthorized access to cloud environments. According to security expert Arda Büyükkaya, the group uses legitimate tools such as Azure's Special Administration Console and Data Factory to avoid detection while executing commands and transferring data.

It remains unclear whether the two Walsall arrests are connected, but both incidents point to a growing trend of cybercriminals exploiting public infrastructure and businesses with devastating consequences.