TfL starts to process new Oyster photocards after a cyber attack forced them to halt requests

Transport for London (TfL) has resumed taking in requests for Oyster photocards after being forced to halt applications following a cyber security attack.

TfL announced today (4 November) that after two months of not being able to accept any applications for Oyster photocards, they are beginning to accept some requests as they continue to restore their services.

From Monday, those applying for new 18+ Student, 18-25 Care Leaver and Apprentice Oyster photocards can submit applications again, with TfL saying they will process these as quickly as they can.

Once new photocards have been issued, TfL intends to refund passengers who have paid more for their travel due to not being able to send in new applications. TfL will provide information on how customers can apply for additional travel cost refunds once photocards start to be supplied.

Oyster cards are a popular payment method for those making their way around London. It is a smart card that you add money to pay for transport around London on the bus, Tube, tram, DLR, London Overground and most Elizabeth line journeys, as well as the cable car and Thames Clippers River Bus services.

Oyster cards can also be used while travelling on National Rail services inside and some outside the capital.

However, on 1 September 2024, TfL identified suspicious cyber activity and took immediate action to secure its network, working with the National Crime Agency and the National Cyber Security Centre throughout the process.

Thousands of customers were contacted by TfL following the incident, explaining that certain customer data had been accessed, including some customer names and contact details, including email addresses, home addresses, as well as possibly bank account numbers and sort codes for a limited number of customers.

From TfL’s investigations so far, there is nothing to suggest that Oyster photocard data has been compromised.

While dealing with the cyber incident, TfL said they made the “difficult decision” to temporarily pause any new concession photocard applications through its website while undertaking security checks.

While the transport body says they are still finalising restorative work to its services, it said it has now “safely” brought back online its concession photocard website and has begun to process new applications.

TfL said it will be phasing the applications, prioritising those who are currently being financially impacted by the cyber incidents and trying to process them as fast as possible.

Goksu Danaci, president of the students’ union at University College London, explained how the reopening of Student Oyster card applications will help alleviate the mounting costs of being a student in the current economic climate.

“The 18+ Student Oyster is a vital initiative for our students and we’re relieved this issue, caused by a recent cyber-attack, is coming to an end.

“Students have had a difficult start to the academic year with continuing cost of living pressures, and travel costs are a large part of a student’s daily expense.

“We’re pleased TfL is now accepting 18+ Student photocard applications again and has committed to refund students for any additional costs they’ve incurred during the time applications have been unavailable."

After prioritising the 18+ Student, 18-25 Care Leaver and Apprentice Oyster photocards, TfL hopes in the coming weeks to start accepting applications for new 60+ Oyster photocards, and by late November, for five-10, 11-15 and 16+ Zip Oyster photocards.

Seb Dance, the deputy mayor for transport in London, said: “TfL has been working incredibly hard around the clock to restore the services which had to be temporarily taken offline while it responded to a highly sophisticated cyber attack.

“The Mayor and I commend TfL on its response, which has kept London moving and avoided the consequences of the attack being even worse.”

For more travel news and advice, listen to Simon Calder’s podcast