Man Arrested Over UK Railway Station Wi-Fi Hack

A man has been arrested on suspicion of involvement in the hack of UK railway stations, which resulted in Islamophobic messages being displayed to passengers attempting to connect to public Wi-Fi.

The British Transport Police (BTP) revealed that the suspect is an employee of Global Reach Technology, which provides some Wi-Fi services to Network Rail. The individual is suspected of “abuse of access” to some Network Rail Wi-Fi services.

The man has been arrested on suspicion of offences under the Computer Misuse Act 1990 and offences under the Malicious Communications Act 1988.

No further information has been given about the suspect.

Defacement References Past Terror Attack

The incident was reported at around 5.00pm BST on Wednesday September 25. The hack impacted numerous major UK train stations managed by Network Rail including London Euston, Manchester Piccadilly and Liverpool Lime Street.

Rail passengers attempting to connect with Network Rail’s Wi-Fi system at these stations redirected them to a webpage with offensive content referencing a past UK terror attack.

Telecommunications company Telent, which operates the affected Wi-Fi system, said the breach was carried out via an unauthorized change to the landing page through a legitimate administrator account.

Network Rail quickly suspended its Wi-Fi service at all its stations nationwide while it continues to address the issue.

The BTP emphasized that the abuse of access was restricted to the defacement of the “splash pages,” and no personal data is believed to be affected.

It is expected that Wi-Fi services at the stations will be restored by the weekend.

The Network Rail hack follows a cyber-attack on Transport for London (TfL) in early September 2024.

In its latest update on the incident, TfL revealed it has written to around 5000 customers whose personal data was accessed by the attackers, including some individuals’ bank account details.

The National Crime Agency (NCA) arrested a 17-year-old male on September 5 on suspicion of Computer Misuse Act offences in relation to the attack.