TfL grapples with Cyber Attack: Concession card renewals delayed until IT systems repaired

Transport for London (TfL) says it is making progress in recovering from a cyber attack that has damaged some of its IT systems, but it is still unable to renew expiring concession cards.

Rebuilding the IT infrastructure is taking a long time, as TfL’s staff are checking the code in many of the services line by line to ensure that nothing was inserted by the hacker or could leave a route open again later. That painstaking task means that TfL can’t process new photocard applications, which means expiring travelcards for concessions, such as students and pensioners, also can’t be renewed.

While TfL staff have been accepting expired cards, there was a risk that national rail companies would stop at the end of this month. Now TfL says that it has agreed with the Rail Delivery Group (RDG) so that rail companies will continue to accept expired zip cards until the end of this year.

As checking and rebuilding the IT network continues, a spokesperson said that they expect to be able to start accepting applications for new concession photocards again, albeit in a phased way, shortly.

The photocards affected are:

• 5-10 Zip Oyster photocard
• 11-15 Zip Oyster photocard

TfL has confirmed that it intends to refund customers who have paid more for their travel than they should have, and in the meantime, customers are being advised to keep a record of any fares that they feel should be refunded. However, while customers will be offered refunds eventually, it has meant that some people who would usually apply for a new photocard are struggling to pay for travel as they have to pay the full fare instead of the concession rates.

A TfL spokesperson said: “Following the recent highly sophisticated cyber security incident, we have been working hard to restore both our internal and customer-focused systems which were impacted by measures introduced as part of our response.”

“In order to give expired Zip photocard holders plenty of time to apply for their new photocard once this begins, TfL and the Train Operating Companies have now extended the acceptance, where usually valid, of expired 5-10 and 11-15 Zip Oyster photocards until 31 December 2024.”

Apart from the concession card renewals, customers have also been unable to see their contactless journey history, correct incomplete journeys or apply for service delay refunds. There have also been some issues with cycle hire customer care systems, and even the LT Museum Friends were affected as they use some of the TfL services.

There has been some progress though as the live next train information is working again on the TfL Go app, and the public API is also working again, which means many third-party apps and websites that rely on it for live travel information are also working again.