Transport for London has reopened applications for some Oyster photocards after a cyber-attack in September forced it to close down many online services.
Students, apprentices and care leavers over 18 can now apply for the discount cards that permit travel at reduced rates, but over-60s and schoolchildren will have to wait until later in the month as TfL tackles the backlog in a phased reintroduction.
The move comes after TfL last month restored data feeds that had been cut, linking Tube service information to third-party apps including Citymapper, as well as its own TfL Go app, allowing customers to check live travel times and journey plans again.
TfL has been unable to provide many online auxiliary services since its systems were hacked over two months ago, although its core transport functions were unaffected.
It has yet to restore full online services to customers who use their contactless bank card for travel, including journey history and issuing refunds for incomplete trips.
However, TfL has assured customers it will retain the data and work through any requests when those systems are restored.
The hack also further delayed the rollout of contactless payments at national rail stations around London by TfL and the Department for Transport.
Another 47 of about 200 stations were due to be connected – allowing daily fare capping and ticketless travel – on 22 September, but the work will now be carried out only after all of TfL’s other systems are back online, at an unconfirmed date.
The deputy mayor for transport, Seb Dance, said: “TfL has been working incredibly hard around the clock to restore the services which had to be temporarily taken offline while it responded to a highly sophisticated cyber-attack. The mayor and I commend TfL on its response, which has kept London moving and avoided the consequences of the attack being even worse.
“We’re really pleased TfL has now started accepting Oyster photocard applications for several concessions, including 18+ student and 18–25 care leavers, and are assured work is ongoing to ensure that other photocard applications are opened as quickly as possible in the coming weeks.”
TfL’s chief technology officer, Shashi Verma, said: “Once customers have successfully applied for a new Oyster photocard, we will also contact them to advise on how to claim for any additional travel costs incurred while the photocard website has been unavailable.”
The hack took place on 1 September, with about 5,000 customers’ details potentially compromised in a file of Oyster card users who had applied for refunds. Verma said it had been a “highly sophisticated” cybersecurity incident, and systems were taken offline to mitigate its effects.
A teenager from Walsall was arrested the following week by the National Crime Agency in connection with the attack.
While the attack has caused some problems internally, with staff denied access to some databases, and TfL having to reset the passwords of about 30,000 employees and contractors in person at its London offices, the most evident public issues have been the inability to access photocards, live Tube data and contactless journey records.
TfL said it would allow schoolchildren with expired Zip photocards to travel until 31 December, and refund any additional travel costs incurred.
Students, as well as several thousand people who have become eligible since 1 September for 60+ Oyster photocards allowing free travel, may be able to claim refunds after applications for new cards are processed later this month.
