--- title: "TfL Hack: 10M records stolen by Scattered Spider | Firevault" description: "Transport for London has confirmed that around 10 million customer records were stolen during the 2024 Scattered Spider cyber attack, making it one of the…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/tfl-hack-10-million-records-stolen-scattered-spider#webpage", "url": "https://fire-vault.com/news/tfl-hack-10-million-records-stolen-scattered-spider", "name": "TfL Hack: 10M records stolen by Scattered Spider", "description": "Transport for London has confirmed that around 10 million customer records were stolen during the 2024 Scattered Spider cyber attack, making it one of the…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/tfl-hack-10-million-records-stolen-scattered-spider#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/tfl-hack-10-million-records-stolen-scattered-spider#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "TfL Hack: 10 Million Records Stolen", "item": "https://fire-vault.com/news/tfl-hack-10-million-records-stolen-scattered-spider" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "TfL Hack: 10 Million Records Stolen", "description": "Transport for London has confirmed that around 10 million customer records were stolen during the 2024 Scattered Spider cyber attack, making it one of the largest data breaches in British history. The revelation raises urgent questions about transparency, regulatory accountability and the case for offline secure storage.", "url": "https://fire-vault.com/news/tfl-hack-10-million-records-stolen-scattered-spider", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-03-11T09:00:00+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/tfl-hack-10-million-records-stolen-scattered-spider" }, "inLanguage": "en-GB", "articleSection": "News", "wordCount": 803, "keywords": "News, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## 10 Million Records Stolen in TfL Cyber Attack Transport for London (TfL) has now confirmed that approximately 10 million people had their personal data stolen during a cyber attack in late 2024, making it one of the largest data breaches in British history. The attack, carried out by hackers linked to the Scattered Spider crime group, breached TfL's internal computer systems between late August", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview 10 Million Records Stolen in TfL…What Was StolenA Transparency GapThe Regulatory ResponseThe Firevault ViewWhat This Means for IndividualsMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · 11 March 2026 # TfL Hack: 10 Million Records Stolen Transport for London has confirmed that around 10 million customer records were stolen during the 2024 Scattered Spider cyber attack, making it one of the largest data breaches in British history. The revelation raises urgent questions about transparency, regulatory accountability and the case for offline secure storage. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 5 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ftfl-hack-10-million-records-stolen-scattered-spider)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ftfl-hack-10-million-records-stolen-scattered-spider&text=TfL%20Hack%3A%2010%20Million%20Records%20Stolen%0A%0ATransport%20for%20London%20has%20confirmed%20that%20around%2010%20million%20customer%20records%20were%20stolen%20during%20the%202024%20Scattered%20Spider%20cyber%20attack%2C%20making%20it%20one%20of%20the%20largest%20data%20breaches%20in%20British%20history.%20The%20revelation%20raises%20urgent%20questions%20about%20transparency%2C%20regulatory%20accountability%20and%20the%20case%20for%20offline%20secure%20storage.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Ftfl-hack-10-million-records-stolen-scattered-spider)[](mailto:?subject=TfL%20Hack%3A%2010%20Million%20Records%20Stolen&body=Transport%20for%20London%20has%20confirmed%20that%20around%2010%20million%20customer%20records%20were%20stolen%20during%20the%202024%20Scattered%20Spider%20cyber%20attack%2C%20making%20it%20one%20of%20the%20largest%20data%20breaches%20in%20British%20history.%20The%20revelation%20raises%20urgent%20questions%20about%20transparency%2C%20regulatory%20accountability%20and%20the%20case%20for%20offline%20secure%20storage.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Ftfl-hack-10-million-records-stolen-scattered-spider) ![Transport for London headquarters exterior, representing the TfL cyber attack that exposed 10 million customer records](/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg) Transport for London headquarters exterior, representing the TfL cyber attack that exposed 10 million customer records Why it matters ## What this means for organisations holding critical data Transport for London has confirmed that around 10 million customer records were stolen during the 2024 Scattered Spider cyber attack, making it one of the largest data breaches in British history. The revelation raises urgent questions about transparency, regulatory accountability and the case for offline secure storage. In this analysis 1. 01 [10 Million Records Stolen in TfL…](#section-0) 2. 02 [What Was Stolen](#section-1) 3. 03 [A Transparency Gap](#section-2) 4. 04 [The Regulatory Response](#section-3) 5. 05 [The Firevault View](#section-4) **On this page**[10 Million Records Stolen in TfL…](#section-0)[What Was Stolen](#section-1)[A Transparency Gap](#section-2)[The Regulatory Response](#section-3)[The Firevault View](#section-4) ## 10 Million Records Stolen in TfL Cyber Attack Transport for London (TfL) has now confirmed that approximately 10 million people had their personal data stolen during a cyber attack in late 2024, making it one of the largest data breaches in British history. The attack, carried out by hackers linked to the Scattered Spider crime group, breached TfL's internal computer systems between late August and early September 2024. While the organisation initially disclosed only that "some" customers had been affected, the true scale has now been revealed by the BBC, which obtained and verified a copy of the stolen database. The breach caused an estimated £39 million in damages and disrupted online services across the London transport network. ## What Was Stolen The stolen database contains names, email addresses, home phone numbers, mobile phone numbers and physical addresses of an estimated 10 million people. In total, the file holds nearly 15 million lines of data, though some are believed to be duplicates. TfL has also confirmed that approximately 5,000 customers were at heightened risk because their Oyster card refund data, including bank account numbers and sort codes, may have been accessed. ## A Transparency Gap TfL sent notification emails to 7,113,429 customers with registered email addresses. However, with only a 58% open rate, millions of affected individuals may never have learned their data was compromised. Companies in the UK are not legally required to publicly disclose the total number of people affected by a [data breach](/learn/breaches). This stands in contrast to other jurisdictions: - In the Netherlands, telecoms firm Odido publicly confirmed six million customers were impacted by an ongoing data extortion attack - In Japan, beer maker Asahi disclosed exactly what data was stolen from around two million people during a [ransomware attack](/threats/ransomware) - In South Korea, e-commerce giant Coupang told the public 33 million customers had been affected and offered vouchers as compensation Data protection consultant Carl Gotleib noted that "after a breach it is essential that individuals are informed exactly what has happened to their data and what the potential risk might be to their privacy." He added that large datasets can be more valuable to attackers and more likely to be used in future fraud attempts. Security researcher Kevin Beaumont described informing the public of the scale of a breach as "the most basic requirement for transparency." ## The Regulatory Response The Information Commissioner's Office (ICO) cleared TfL of any wrongdoing for the breach and its handling of the aftermath, ruling in February 2025 that no further action was needed. The regulator confirmed it was informed of the full extent of the breach but concluded formal regulatory action was "not proportionate." The trial of two British teenagers accused of carrying out the hack is set to begin in June 2026. ## The Firevault View > This breach illustrates a structural problem that no amount of perimeter security can solve. Once attackers are inside the network, digitally connected data is exposed in its entirety. Ten million records were exfiltrated because they were stored in a system that was always online and always reachable. > Firevault's [offline secure storage](/offline-secure-storage) model eliminates this attack surface entirely. Data held in a physically disconnected vault cannot be downloaded, copied or exfiltrated remotely, regardless of whether an attacker has breached the surrounding network. Physical isolation is not a feature. It is the architecture. The TfL breach is a clear example of why organisations and individuals need to rethink where their most sensitive data resides. Cloud-connected databases remain the single largest target for organised cyber crime groups like Scattered Spider. [Learn how Firevault's Vault protects what matters most](/products/vault) or [explore our offline-first platform architecture](/products/platform). ## What This Means for Individuals For the estimated 10 million people affected, the immediate risk remains low but the long-term exposure is significant. Stolen databases are routinely traded in hacker communities and used to fuel phishing, scam and fraud campaigns months or years after the original breach. Affected individuals should: - Be vigilant for unexpected communications referencing TfL or transport services - Monitor bank accounts linked to Oyster card refunds for suspicious activity - Consider whether sensitive personal documents are stored in always-online systems that could be similarly compromised The question is no longer whether your data will be targeted. It is whether it will be reachable when it is. **How Firevault helps** - **[Offline Secure Storage](/offline-secure-storage)** keeps gold-copy data physically disconnected from the network, so a ransomware or exfiltration event cannot reach it. - **[Control](/control)** gives boards and operators a single view of what is online, what is isolated, and what is recoverable across the estate. - **[Firebreak](/firebreak)** delivers hardware-enforced disconnection at Layer 1, so exposed credentials or compromised network paths cannot become a route into the vault. _Talk to Firevault about [Disconnect to Protect®](/about) for your organisation._ Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis [View original article](https://www.bbc.co.uk/news/articles/cx2lp214l14o) About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. [Get started](/get-started)[Talk to the team](/demo) **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful [ ![Firevault Awarded Cyber Essentials and Cyber Essentials Plus Certification](/__l5e/assets-v1/446b675b-b48b-4b8e-ba01-b97ad3abf97d/firevault-cyber-essentials-plus-certified-2x.jpg) News ### Firevault Awarded Cyber Essentials and Cyber Essentials Plus Certification Firevault has been awarded Cyber Essentials and Cyber Essentials Plus certification, the UK Government-backed scheme run by the NCSC, following an independent technical audit of its systems and controls. 26 Jul 2026 2 min ](/news/firevault-cyber-essentials-plus-certified)[ ![Russian hackers steal UK government logins: why offline vaults change the equation](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Frussian-hackers-uk-government-logins.jpg) News ### Russian hackers steal UK government logins: why offline vaults change the equation The Telegraph reports that Russian-linked hackers have harvested UK government login credentials and traded them on dark-web forums. The incident is a reminder that credentials, however well protected in the cloud, remain the single point of failure that offline data vaults are designed to remove. 7 Jul 2026 4 min ](/news/russian-hackers-steal-uk-government-logins-offline-vaults)[ ![Great Marlow School partially closed after cyber attack](/news/great-marlow-school-cyber-hero.jpg) News ### Great Marlow School partially closed after cyber attack A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what it tells us. 14 Jun 2026 4 min ](/news/great-marlow-school-cyber-attack-partial-closure)[ ![School Ransomware: Files Must Live Offline](/__l5e/assets-v1/5dcdf155-e287-48e8-bf9b-82b9837b80d0/school-ransomware-safeguarding-2x.jpg) News ### School Ransomware: Files Must Live Offline St Anne's Catholic School in Southampton was shut for four days after ransomware hit its network. It is not the first school to be targeted. From nurseries to councils, sensitive safeguarding data remains dangerously exposed on connected systems. 27 Mar 2026 7 min ](/news/st-annes-southampton-ransomware-safeguarding-files-physically-offline)[ ![Firevault: 2025 Tech Trailblazers Shortlist](/__l5e/assets-v1/c2acabab-9ada-4969-9d69-b18478181083/firevault-shortlisted-trailblazers-v2-1771248067838-2x.jpg) News ### Firevault: 2025 Tech Trailblazers Shortlist We’re proud to announce that Firevault Limited has been shortlisted for the 2025 Tech Trailblazers Awards, recognised in the Firestarter category. For a young… 29 Nov 2025 6 min ](/news/firevault-shortlisted-for-the-2025-tech-trailblazers-firestarter-award)[ ![Sona Insurance Partners with Firevault](/__l5e/assets-v1/4590a187-a191-4f4d-a295-bab12f2594cc/sona-insurance-partnership-1771248017904-2x.jpg) News ### Sona Insurance Partners with Firevault We’re proud to announce that Sona Insurance Solutions , the Colchester-based independent insurance broker, has become the first broker in the UK to partner… 10 Nov 2025 3 min ](/news/sona-insurance-solutions-partnership) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)