Russian Hackers Breach Ulez Database

The Clop cybercrime gang strikes again, this time stealing the data of 13,000 drivers on the Ulez and Congestion Charge databases in an attack against Transport for London (TfL). TfL has written to the 13,000 drivers affected by the data breach, stating that their details were stored by a contractor responsible for the controversial ultra-low emissions zone (Ulez).

A spokesman said: "Like other companies in the UK, one of our contractors recently suffered a data breach. The issue has been fixed and the IT systems have been secured." The warning from TfL follows a statement from Ofcom released on Monday, who admitted that they too had been victims of the Clop gang. Around 400 Ofcom staff had their payroll information stolen, and "confidential" data was also taken by the hackers.

This comes just days after British Airways and the BBC were also attacked by the Clop group, with a flaw in the MOVEit file transfer software allowing the hackers to make off with confidential information. British Airways saw employees' bank account details leaked, and the BBC is still actively working to determine the full extent of the data exposed on their end.

The Information Commissioner's Office (ICO) was informed of the attack at TfL, and the UK authorities are currently on high alert to see if any of the compromised data (which includes bank details, National Insurance numbers and home addresses) is sold on the dark web overnight, as the Clop gang's ransom has a deadline set for tomorrow.

GCHQ’s security arm, the National Cyber Security Centre, has been contacting affected British companies to ensure that they secure their servers against hackers. Fortunately, their warning came quickly enough for some of the businesses to close an active loophole before they were hit with a ransom request. Even though a ransom was not requested for those businesses, it is still assumed that their data was indeed exfiltrated.

British government statistics show that cyber attacks affected 40 percent of all UK businesses last year, and the average cost to the businesses affected is believed to be £19,400. Even small businesses had data breach remedy costs starting at £11,000, according to insurer Hiscox. This can easily head into the millions of pounds just in ransom payouts and clean-up costs for larger organisations.