A major cyberattack targeting Wi-Fi networks at UK railway stations, including London Euston and Manchester Piccadilly, has caused widespread disruption and displayed Islamophobic content. Authorities are investigating the incident and working to restore services.
A major cyberattack has disrupted Wi-Fi services at numerous railway stations across the United Kingdom, including ten in London. The attackers exploited vulnerabilities in the Wi-Fi networks to display Islamophobic messages, causing widespread concern and prompting a swift investigation by authorities.
The incident, which occurred at 5:03 PM on September 25, 2024, affected around 20 stations managed by Network Rail, a leading infrastructure company in the UK. including the following:
- Euston
- Reading
- Victoria
- Waterloo
- Guildford
- Leeds City
- Paddington
- King’s Cross
- Cannon Street
- Charing Cross
- London Bridge
- London Euston
- Glasgow Central
- Clapham Junction
- Liverpool Street
- Edinburgh Waverley
- Liverpool Lime Street
- Bristol Temple Meads
- Birmingham New Street
- Manchester Piccadilly
Nightsleeper-style Attack
It is worth noting that the UK train Wi-Fi hack is being dubbed a “Nightsleeper-style” attack because it draws similarities to the fictional cyberattacks depicted in the BBC’s Nightsleeper series. In both, hackers target transportation networks, exploiting vulnerabilities in their systems to spread malicious content and cause widespread disruption.
Just as in the series, where coordinated digital sabotage leads to chaos onboard trains, this real-life attack hijacked Wi-Fi networks across UK railway stations, injecting harmful and offensive messages. Both scenarios highlight the ease with which critical infrastructure can be compromised, raising concerns about cybersecurity in public transport systems.
“We love you, Europe“
Manchester Evening News reported passengers who attempted to connect to the Wi-Fi at these stations were met with a webpage displaying ‘We love you, Europe,’ and containing details of terrorist incidents in the UK and abroad. The message also included Islamophobic content, raising concerns about the attackers’ motives and potential links to extremist groups.
Network Rail confirmed that the Wi-Fi systems were quickly taken offline to contain the attack and prevent further damage. The company emphasized that the affected Wi-Fi networks were provided by a third-party vendor and did not collect any personal data from users.
“The Wi-Fi is provided by a third party, is self-contained and is a simple ‘click & connect’ service that doesn’t collect any personal data. Once our final security checks have been completed we anticipate the service will be restored by the weekend,” Network Rail’s spokesperson stated.
Telent, a third-party provider, reportedly, controls Wi-fi at affected stations. MailOnline claims that other organizations may have also been affected.
Wi-Fi services at all impacted stations got suspended and remained down on Thursday morning due to the hack. The British Transport Police is investigating the cyberattack in collaboration with Network Rail and other relevant agencies to identify the perpetrators and bring them to justice. The authorities are also investigating the potential motives behind the attack and whether it was linked to any specific group or ideology.
The incident underscores the growing threat of cyberattacks on critical infrastructure, emphasizing the need for organizations to invest in robust cybersecurity measures to safeguard their systems and data from malicious actors.