The Cyberattack That Brought a City to a Standstill

According to a report by The Hacker News, two young hackers were recently sentenced to five and a half years in prison for breaking into Transport for London (TfL) in 2024. The attack shut down 148 systems, forced 27,000 employees to reset passwords in person, and cost the transit authority £29 million. This case is a stark reminder that even massive, well-funded organisations can be crippled by a small group of determined attackers.

The hackers used a technique that many Australian business owners might not take seriously: social engineering. They called employees, pretended to be IT support, and tricked them into handing over login credentials. Once inside, they moved quickly and caused widespread damage. The fact that both attackers were teenagers shows that cybercrime is no longer the domain of shadowy, elite criminals — it can be anyone with a phone and a willingness to exploit human trust.

Why This Case Matters Beyond London

What makes this attack significant is not just the scale, but the method. The hackers didn't use complex software exploits. They relied on convincing people to do what they asked. This kind of attack — known as "vishing" (voice phishing) — works because it targets the weakest link in any security chain: the human being. For Australian SMBs, which often lack dedicated security teams, this is a critical vulnerability.

Another key takeaway is how TfL responded. When they detected the intrusion, they pulled their own network offline. That decision prevented a potentially catastrophic shutdown that could have cost the UK economy billions. It also preserved crucial evidence for law enforcement. Many Australian businesses hesitate to shut down systems for fear of lost revenue, but in this case, it saved the organisation from far worse damage.

What This Means for Australian SMBs

Australian small and mid-sized businesses face the same threats as TfL, but with fewer resources to defend themselves. Cybercriminals don't discriminate based on size — they look for easy targets. A single employee who answers a convincing phone call could give attackers access to your customer database, financial records, or operational systems. The cost of cleaning up after a breach can easily run into hundreds of thousands of dollars, and many SMBs never fully recover.

The TfL hack also highlights the importance of reporting attacks to authorities early. The prosecutors in this case said the convictions likely wouldn't have happened if TfL hadn't called law enforcement immediately. In Australia, both the Australian Cyber Security Centre (ACSC) and state police have dedicated cybercrime units that can help. Many business owners worry about reputational damage from reporting, but the alternative — staying silent and letting attackers strike again — is far worse for the entire community.

What You Can Do Now

  • Train your staff to spot social engineering. Run regular, simple drills where someone calls pretending to be IT. Teach employees to verify requests by calling back using a known number, not one the caller provides.
  • Require multi-factor authentication (MFA) on all accounts. But don't stop there — use phishing-resistant MFA, like hardware security keys or app-based push notifications, to make it harder for attackers to steal codes.
  • Create an incident response plan that includes a "pull the plug" step. Decide in advance who can shut down systems and under what circumstances. Practice this scenario at least once a year.
  • Set up strong identity verification for password resets. Do not allow employees to reset passwords over the phone without verifying their identity through a separate channel, such as a manager approval or an in-person meeting.
  • Build a relationship with local cybercrime authorities now. Contact the ACSC or your state police cyber unit to understand what information they need if you are ever breached. Having that contact ready saves precious time during a crisis.

At MS&VG, we help Australian SMBs strengthen their cybersecurity posture without overwhelming their teams. From security awareness training to incident response planning, we can guide you through the steps that make a real difference.