How Putin could bring Britain's railways to a halt

The UK’s rail network is vulnerable to a major cyber attack that could disrupt train journeys for a week and cost the economy £1.8bn, The i Paper can reveal. A hack on Britain’s railway communications would paralyse some lines immediately, while others would be forced to run at reduced speeds. The stark admission is contained in Department for Transport (DfT) documents setting out plans to bolster the network’s resilience against cyber attacks, extreme weather and other threats.

Cyber criminals linked to hostile states could target the network by 2028 and an attack on a specific geographical area would be enough to spread disruption to other parts of the country, leading experts say. Concerns over the vulnerability of the UK’s critical infrastructure have grown in recent weeks, with a spate of bomb hoax threats grounding planes across Europe and remote cyber hackers turning up the temperatures in fridges and freezers in supermarkets and blood banks .

Security officials are examining whether Russia is behind the disruption given Vladimir Putin has been ramping up “grey warfare” against the West. The head of the UK military Sir Richard Knighton warned on Sunday of Moscow’s mounting appetite for risk. “We’re talking about targeted assassinations, we’re talking about sabotage, we’re talking about cyber attacks,” he said. “These are very real, real things.” A cyber expert, who used to work for the Ministry of Defence (MoD), said there was a “realistic possibility” a hack could play a role in major disruption to the rail network.

KPMG research that was commissioned by the Government estimates that a cyber attack on Network Rail’s train communications system would last a week and cost the economy £1.8bn, including £281.3m in passenger delays. The researchers assessed the likelihood of the scenario as low. But Professor Raj Rajarajan, director of the Institute for Cyber Security at City St George’s, University of London, said he believed a hostile state would “definitely try” to carry out a major hack on the UK’s critical transport infrastructure.

He told The i Paper : “I expect by 2028 there will be one.” Experts believe an attack would likely involve jamming communication methods, and that a hack on the railways that focused on a particular geographical area would be enough to spread disruption to other parts of the country. The Department for Transport’s resilience strategy reports that the sector has a problem with learning from previous incidents, and implementing new measures.

It also states that cyber resilience and preparedness must form an “integral part” of business planning. Operators need to identify vulnerabilities in their systems, map their dependence on other critical infrastructure and have robust plans for responding to cyber incidents, the report recommends. The DfT will work with the sector over the next five to 10 years to enhance cyber security, including better information-sharing, coordinated stress tests and improved mapping of critical infrastructure.

Last week, The i Paper reported that Britain’s public electric vehicle charging network also had cyber vulnerabilities. Britain’s railways have been targeted by hackers before, though attacks have so far hit passenger and business systems rather than infrastructure controlling train movements. In 2021, a ransomware attack knocked Northern’s ticket machines offline for a week, while in 2024 hackers hijacked Wi-Fi login pages at 19 Network Rail stations to display Islamophobic messages.

Neither incident disrupted train operations, but they underline the sector’s exposure to cyber threats Dan Bird, field chief technology officer for cyber security firm Horizon3 who worked on critical infrastructure for the MoD for 20 years, said: “Railways depend on communications to work safely. Break those communications, and you break the railway. “All digital communication systems are susceptible to some degree to error, interference or failure.”

Bird said that these systems were built with safety in mind and “not to withstand a determined [cyber] attacker”. “For those actors that seek widespread harm, rail is an attractive target,” Bird said. He warned that a rail networks’ many links to suppliers, maintenance contractors and corporate IT systems create multiple routes for attackers, who often target third parties rather than trying to breach the most secure systems directly. He pointed to the 2024 Network Rail Wi-Fi hack as an example of that risk, and said advances in artificial intelligence are making it easier for hackers to identify and exploit vulnerable targets at scale.

Dr Marius Muench, an assistant professor at the University of Birmingham, said there are two main ways hackers could target rail signalling systems. One would involve physically gaining access to a train’s communications network and sending false signalling information. The other would be a remote attack on the wider signalling and radio systems used to control trains, which could in theory allow hackers to disrupt services or even trigger emergency stop messages causing trains to break down.

“You can launch localised attacks,” Rajarajan said, adding that it would “cause a lot of economic damage because you pretty much have to stop the system [to fix it]. Phil Tonkin, field CTO at Dragos and a former National Grid cyber security expert, said understanding the risks of passenger disruption and wider economic damage was key for operators to plan how services could continue running safely if systems were compromised. “Many of the measures needed to reduce these risks are already well understood, but their effectiveness depends on operators applying them consistently and ensuring they are regularly tested, rather than simply recording lessons after an incident,” Tonkin said.