LNER confirms customer's names and email addresses exposed during cyber breach

Password and card data not compromised, according to the company

London North Eastern Railway (LNER) has confirmed that customer names and email addresses were accessed illegally during a September cyber breach linked to one of its third-party suppliers.

In a letter to affected customers, the publicly owned LNER said the attack occurred on 8th September, when a supplier managing its customer communication database suffered a security breach.

"A third party gained unauthorised access to the supplier's networks and in the process gained access to customer data," it said.

"As a result of our investigation of the breach so far, we have concluded that the data included some personal information, specifically customer names and email addresses."

No passwords, payment card details, or LNER account details were involved in the breach, and its ticketing systems remain unaffected, according to the company.

"Our core train services and ticketing systems are safe. You can continue to buy tickets from LNER as normal," the operator added.

The operator has warned passengers to be on the lookout for phishing or scam messages that could exploit their stolen information.

"Because some people had their names and email address affected, it's possible they will receive phishing or scam messages," the company said.

LNER, part of the Department for Transport's (DfT) rail portfolio, runs intercity services on the East Coast Main Line between London, Yorkshire, North East England and Scotland.

The company has reported the incident to the Information Commissioner's Office (ICO) as required by law. It also notified the National Cyber Security Centre (NCSC), British Transport Police (BTP), and the Department for Transport on the day of the breach.

As a precaution, LNER said it has temporarily paused some customer communication channels while it investigates the incident.

The supplier involved has engaged independent security experts to strengthen its systems and implement new security measures aimed at preventing future breaches.

Growing cyber threat

The LNER breach comes amid a sharp rise in cyberattacks across the UK's transport and industrial sectors.

A year ago, Transport for London (TfL) suffered an incident that exposed financial data of about 5,000 customers, forcing parts of its online systems offline for weeks.

In August, Jaguar Land Rover, Britain's largest car manufacturer, was forced to pause production after hackers disrupted access to key operational data and retail giants including Marks & Spencer, Harrods, and the Co-op have also faced cyber intrusions this year.

Earlier this week, the National Cyber Security Centre (NCSC) released its Annual Review, painting a grim picture of the UK's digital defences.

According to the report, the NCSC handled 204 nationally significant cyberattacks in the year ending August 2025, the highest level of activity recorded in its nine-year history.

This represents a 129% increase compared with the previous year's 89 cases. In total, the agency dealt with 429 incidents, of which 18 were categorised as "highly significant", meaning they had the potential to seriously impact essential national services.

That figure marks a 50% rise from 2024 and continues a three-year upward trend in severe cyber incidents.

If you’re a current or aspiring cybersecurity leader check out the Computing Security Leaders Summit on March 26th 2026. Packed with content including business continuity planning, bridging the cyber skills gap and cloud resilience, its promises to be full of insight and practical advice to take away. Register here for your free place.