Mobile & Wireless

Police Are Probing a Cyberattack on Wi-Fi Networks at UK Train Stations

An investigation has been launched into a Wi-Fi service hack that has impacted many train stations in the United Kingdom.

Wi-Fi attack

U.K. transport officials and police said Thursday they are investigating a “cyber-security incident” that hit the public Wi-Fi networks at the country’s biggest railway stations.

Passengers trying to log onto the Wi-Fi at stations including Manchester Piccadilly, Birmingham New Street and 11 London terminuses on Wednesday evening were met by a page reading “We love you, Europe,” followed by an anti-Islam message listing a series of terror attacks.

Network Rail, which manages the stations, said the Wi-Fi had been switched off and no passenger data was taken.

“British Transport Police are investigating the incident,” Network Rail said in a statement. “This service is provided via a third party and has been suspended while an investigation is under way.”

The incident follows a more disruptive cyberattack in early September on Transport for London, which runs the capital’s bus, subway and suburban train system.

TfL said some customer names, contact details and potentially bank account details were exposed in the attack, which is being investigated by the National Crime Agency.

Advertisement. Scroll to continue reading.

A 17-year-old was arrested over the attack, questioned and bailed without being charged.

Weeks on, the attack continues to affect the transit company’s ability to provide some online services such as refunds and real-time transit information.

Related: Norfolk Southern Says a Software Defect — Not a Hacker — Forced It to Park Its Trains This Week

Related: Cyberattack Causes Trains to Stop in Denmark

Related: New Wi-Fi Authentication Bypass Flaws Expose Home, Enterprise Networks

Related Content

Data Breaches

Most of the data is related to applications, claims, and payments submitted between 2007 and 2025.

Data Breaches

Hackers compromised a third-party communication platform and sent rogue notifications to ASOS users.

Government

Late amendments to the Cyber Security and Resilience Bill would give ministers new powers to restrict risky technology providers as supply chain attacks intensify.

ICS/OT

The attack caused real-world operational disruption and raised concerns about the resilience of Britain’s distributed energy infrastructure and the potential for repeatable attacks.

Data Breaches

The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts.

Mobile & Wireless

Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations.

Malware & Threats

A threat actor has been using the compromised appliances to target the Microsoft 365 accounts of traveling corporate employees.

Cybercrime

Thalha Jubair and Owen Flowers were prosecuted over a 2024 cyberattack targeting Transport for London (TfL).

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version