LNER Cyber Attack Exposes Passenger Data

London North Eastern Railway (LNER) has confirmed a cyber attack that compromised passenger contact details and journey information. The breach, detected on September 10, 2025, involved unauthorized access to files managed by a third-party supplier responsible for processing customer communications and travel history analytics. LNER emphasized that no financial information, such as bank account numbers, payment card details, or passwords, was accessed during the incident.

UK Train Operator Confirms Customer Data Breach via 3rd-Party SupplierLNER Confirms Passenger Data Breach Following Cyber AttackStamford Mercury

Despite the breach, LNER has assured customers that its ticketing platform and rail services remain fully operational. There has been no disruption to train schedules or the ability to purchase tickets. LNER is actively collaborating with cybersecurity experts and the affected supplier to investigate the breach's extent and implement additional safeguards.

LNER Confirms Passenger Data Breach Following Cyber Attack

In light of the breach, LNER has advised passengers to exercise caution regarding unsolicited communications, particularly those requesting personal information. Customers are encouraged to verify any suspicious messages through LNER's official channels and to refrain from responding to potential phishing attempts. While no password resets are mandatory, LNER recommends maintaining strong, unique passwords and enabling multi-factor authentication where possible.

LNER Confirms Passenger Data Breach Following Cyber AttackStamford MercuryUK Train Operator Confirms Customer Data Breach via 3rd-Party Supplier

This incident is part of a troubling trend in the UK transport sector, which has seen a rise in cyber attacks targeting third-party providers. Previous breaches, such as the 2024 attack on Transport for London (TfL) that exposed financial records of approximately 5,000 customers, highlight the vulnerabilities in the industry. Experts suggest that attackers increasingly exploit weaknesses in third-party vendors to access sensitive data from larger organizations like LNER.

LNER warns customers to remain vigilant after personal data exposed in cyber attack

LNER has stated, “We are treating this matter with the highest priority and are working closely with experts and with the supplier to understand what has happened and to make sure appropriate safeguards are in place.” The company is also in contact with the Information Commissioner’s Office to determine if the breach falls under the reporting requirements of the UK’s General Data Protection Regulation (GDPR).

UK Rail Operator LNER Confirms Cyber Attack Exposing Passenger Data

William Wright, CEO of Closed Door Security, expressed concerns about the vagueness surrounding the breach, noting that it is unclear whether it was an insider job or an external cybercriminal attack. He warned that the exposed data could be used to create detailed profiles for phishing scams, urging customers to remain vigilant.

UK Rail Operator LNER Confirms Cyber Attack Exposing Passenger DataLNER warns customers to remain vigilant after personal data exposed in cyber attack

LNER is conducting a thorough review of its third-party supplier's security protocols and will provide updates as investigations progress. The company has committed to keeping customers informed about any significant developments related to the breach.

LNER Confirms Passenger Data Breach Following Cyber Attack

• “We are treating this matter with the highest priority and are working closely with experts and with the supplier to understand what has happened and to make sure appropriate safeguards are in place.” — LNER Spokesperson

The Telegraph - UK

• “Information relating to this breach is vague, so it’s hard to say exactly how this attack was executed,” — William Wright, CEO of Closed Door Security

UK Rail Operator LNER Confirms Cyber Attack Exposing Passenger Data

This incident underscores the importance of robust cybersecurity measures, particularly in sectors that handle large volumes of personal data.

LNER warns customers to remain vigilant after personal data exposed in cyber attack