Ransomware attack takes down ticket machines

Northern Rail claimed that the alleged attack was a supply chain issue

A suspected ransomware attack has caused more than 600 touchscreen ticketing machines across the north of England to go offline.

It comes just two months after 621 machines were installed at hundreds of stations across the region, at a cost of about £17 million.

The entire system has been offline since last week, and an investigation is currently under way.

In a statement on its website, the operator said that it has been experiencing technical issues with its ticketing machines, which caused all machines to be taken offline.

'We are investigating the issue and are working hard to have the machines up and running again as soon as possible,' Northern Railway said.

The operator apologised to customers for the inconvenience, and advised them to use its website or mobile app to purchase tickets in advance. Customers can collect those tickets from Northern Railway's ticket offices.

'Customers who have already bought tickets to be collected at a machine, or who would normally use 'promise to pay' slips, should board their booked service and either speak to the conductor or to Northern staff at their destination station,' it added.

The government-run operator confirmed to the BBC that it was investigating the issue with its supplier, Flowbird, although evidence points towards a ransomware attack.

A spokesperson for Flowbird said the issue was first identified through the company's cyber monitoring systems.

"We immediately instigated our major incident procedure in order to protect other parts of the network and our checks have shown there has been no compromise to any personal data."

The spokesperson added that the incident has only affected the servers operating the ticket machines. No customer information or payment data was compromised in the attack.

Northern Railway, which serves cities and towns across northern England, was previously operated by Arriva Rail North.

The government took control of the company last year after a series of issues, including a change in timetable that led to delays and service cancellations.

On Monday, the operator told its customers that 'services across the network may be subject to short notice cancellations and timetable amendments this week.'

'All customers are advised to check before they travel as the disruption could affect any route in the north,' it said, adding that the disruption was being caused by 'a large number of drivers and conductors either being diagnosed with COVID-19 or having to self-isolate'.