A cyber-attack has caused disruptions at Go-Ahead, the largest bus operator in London.

With the company’s bus and driver rosters targeted by threat actors, there were concerns that the attack could disrupt operations

However, so far, the company said it has avoided passenger disruption and expects services to return to normal by Wednesday the 7th of September.

At present, the nature of the incident is unknown, whether it was a ransomware attack or whether the company’s data were breached.

The company said that it detected unauthorised activity on its network on Monday the 5th of September.

“Upon becoming aware of the incident, Go-Ahead immediately engaged external forensic specialists and has taken precautionary measures with its IT infrastructure whilst it continues to investigate the nature and extent of the incident and implement its incident response plans,” a company statement noted.

“Go-Ahead’s bus companies are operating a normal service today in spite of the cybersecurity incident. Although certain technology functions are unavailable, backup procedures have been put in place and buses are running as usual. We are confident of operating a comprehensive service tomorrow.”

It added: “Go-Ahead will continue to assess the potential impact of the incident but confirms that there is no impact on UK or International rail services which are operating normally.”

The company is working with IBM to restore its systems from backup. In addition, it has said that it had notified relevant regulators, including the Information Commissioner’s Office (ICO).

The company operates more than 2,400 buses in London and employs over 7,000 staff. In addition to London, the Newcastle-based company operates bus services across England.

Recommended

• DIGIT Movers and Shakers | August 2022
• UK’s first medical drone delivery network begins next phase
• Employability academy launched as tech staff shortages continue

Commenting on the news, CEO of CyberSmart Jamie Akhtar said: “While we know very little about the perpetrators or even the kind of attack carried out on Go-ahead, this incident does speak to a broader trend.

“We’re increasingly seeing cybercriminals attacking critical infrastructure. Sometimes this is down to geopolitics and other times simply that cybercriminals want to cause the maximum disruption possible.

“Unfortunately, many organisations in the sector also have poor cyber defences, presenting themselves as an enticing target for cybercriminals. It’s clear that, as these attacks become more common, organisations need to take stock of their cybersecurity and identify any gaps. Anything else risks a disaster.”

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.