The dreaded return to commuting after working from home has taken a new twist for Northern Rail passengers in the past week. The government-run operator has been targeted by a ransomware attack on its new self-service touchscreen ticketing machines, just two months after 621 of them were installed at a cost of £17m. At the time of writing the situation is yet to be resolved and the system is still offline, and given that Northern Rail is government-run it seems incredibly unlikely that any sort of ransom will be paid.

Commenting on the news, Andy Norton, European cyber risk officer at Armis said "Given how recent the installation was, it would appear some basic security mechanisms are missing from the recent deployment. The ticketing system is likely Android based, and there is a small number of ransomware families that specifically target Android devices. Rail networks are considered critical infrastructure under the NIS legislation and so, a risk assessment of the new Ticketing system should have been undertaken and his risk assessment should have included the risk of Cyber attack with mitigating controls."

For Kelvin Murray, Senior Threat Research Analyst at Webroot, the transport sector is an increasingly tempting and vulnerable target for such attacks: "Even a few hours of disruption to a transport hub can cause millions of pounds of losses, and the knock-on effect to commuters, commerce, and business can be huge. Touchscreens have become a part of our lives, from train stations to fast food venues, and while they definitely can make life easier, any business should have redundancy plans for outages such as these." For now at least it seems like ‘thieves on the line’ might have to be added to the lexicon of railway disruption.

Ending on a more positive note there’s still time to nominate your finalists for the 2021 Network Computing Awards. Nominations close on August 4th however so please visit the awards website before then to make yours.

To make sure you get your copy of the Newsletter emailed to you personally, every time, click here to register.