The NCA and NCSC Lead the Response to the Cyber Attack on Transport for London


The National Crime Agency (NCA) and the National Cyber Security Centre (NCSC) are leading the fight against cybercrime in the UK, as demonstrated by their swift and decisive response to the cyber attack on Transport for London (TfL) in September 2024. Join us at the Public Sector Cyber Security Conference, to hear from Paul Foster, Head of Cyber Crime at the NCA’s National Cyber Crime Unit (NCCU), who led the response.

REGISTER FREE: Public Sector Cyber Security Conference


Amidst the UK’s Cyber Security Strategy, public sector organisations face an ever-evolving threat landscape, intensifying cybersecurity and data protection challenges. Despite progress, the rise of sophisticated cyber attacks necessitates heightened vigilance. The attack on TFL was just one of the estimated approximately 7.78 million cyber crimes the previous year (Cyber Security Breaches Survey, 2024).

The TfL Cyber Attack

In this attack, sensitive data, including bank details of around 5,000 customers, was exposed, prompting an immediate investigation. A 17-year-old suspect was arrested on suspicion of Computer Misuse Act offences and was later bailed (BBC).

The NCA is overseeing the law enforcement response, collaborating closely with the NCSC and TfL to manage the incident and reduce any associated risks. This event underscores the vital role that both the NCA and NCSC play in mitigating cyber threats and responding effectively to such incidents.


“We have been working at pace to support Transport for London following a cyber attack on their network, and to identify the criminal actors responsible.” said Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit.

“Attacks on public infrastructure such as this can be hugely disruptive and lead to severe consequences for local communities and national systems.

“The swift response by TfL following the incident has enabled us to act quickly, and we are grateful for their continued co-operation with our investigation, which remains ongoing. 


“The NCA leads the UK’s response to cybercrime. We work closely with partners to protect the public by ensuring cyber criminals cannot act with impunity, whether that be by bringing them before the courts or through other disruptive and preventative action.”


Read his interview here – https://www.nationalcrimeagency.gov.uk/news/arrest-made-in-nca-investigation-into-transport-for-london-cyber-attack.

At the upcoming Public Sector Cyber Security Conference, Paul Foster, Head of Cyber Crime at the NCA’s National Cyber Crime Unit (NCCU), will lead a keynote session titled Preparing for the Next Generation of Ransomware. This session will focus on the increasing sophistication of ransomware attacks and the need for robust incident management protocols within public sector organisations.

REGISTER FREE: Public Sector Cyber Security Conference

The NCA and NCSC’s Combined Role


Both agencies are essential to the UK’s cybersecurity framework. The NCA, through its NCCU, leads law enforcement efforts to investigate cybercrime, while the NCSC provides critical technical expertise and support to protect public infrastructure. Their coordinated response to the TfL attack showcased how crucial their collaboration is in defending against increasingly sophisticated cyber threats.


The upcoming conference sessions led by the NCA and NCSC will be invaluable in equipping public sector organisations with the knowledge and tools to face these challenges. By focusing on improving incident response, fostering cybersecurity awareness within organisations, and addressing common vulnerabilities, these agencies are helping to safeguard the nation’s critical systems against future cyberattacks.



The Public Sector Cyber Security Conference 2025

Key Points from Paul Foster’s Keynote:

  • Incident Management Best Practices: Foster will emphasise the importance of improving immediate response and quarantine protocols when dealing with ransomware breaches. Quick isolation of infected systems is essential to limiting damage, as demonstrated by TfL’s rapid response, which helped minimise the attack’s impact.

  • Adapting to the Evolving Threat Landscape: Foster’s keynote will offer an analysis of the changing ransomware threat landscape. This underscores the need for organisations to remain vigilant and adaptable to these evolving threats​.
  • Creating a Culture of Cyber Preparedness: Beyond technical defences, Foster will discuss the importance of developing a cybersecurity-focused organisational culture. Regular auditing, staff training, and practice schedules are essential for ensuring that employees can confidently isolate and respond to ransomware breaches.
  • Identifying Internal Risks: Foster will recommend conducting internal surveys to identify vulnerabilities within systems. Understanding where risks lie is key to preventing future attacks and strengthening overall cyber resilience.

NCSC’s Panel on Cybersecurity in the Public Sector

The NCSC will also participate in a panel discussion addressing the broader challenges that public sector organisations face in securing their IT infrastructure, called “Preparing for the Future Amidst a Rapidly Evolving Threat Landscape“

  • Current Threats: The panel will provide an overview of the common vulnerabilities in public sector systems, such as outdated software and weak patch management. These flaws are often exploited by cybercriminals to gain access to critical infrastructure
  • Data Sharing and Collaboration: One of the NCSC’s key recommendations will focus on securely sharing data with external partners to improve collective awareness and prevent breaches. Building long-term relationships with partners, including those involved in software design and procurement, will also be discussed as a way to bolster cyber defences
  • Strategies for Containing Threats: The NCSC will offer practical strategies for detecting, protecting against, and containing vulnerabilities within IT systems. These proactive measures are critical to safeguarding public sector organisations against ransomware and other cyber threats

Want to learn more? Fill in the form below




Join us to receive the latest updates on the threat landscape. Discover the strategies and tactics required to successfully defend your organisation against attacks. Share experiences with your peers around the UK. Find the partners and solution providers you need to meet your challenges and stay secure.

REGISTER FREE: Public Sector Cyber Security Conference

Related Resources

Building Cybersecurity Talent: Attracting and Training the Next Generation

Building Cybersecurity Talent: Attracting and Training the Next Generation

As cyber threats continue to evolve, the demand for skilled cybersecurity professionals is growing rapidly, outpacing the supply of qualified talent. As industries worldwide grapple with this shortage, education and workforce development initiatives are stepping up to attract and train the next generation of cybersecurity talent.

Artificial Intelligence in Cybersecurity: Defensive Applications and AI Threats

Artificial Intelligence in Cybersecurity: Defensive Applications and AI Threats

Artificial Intelligence (AI) has become a crucial tool in the cybersecurity landscape, offering advanced capabilities to detect, prevent, and respond to cyber threats. In the UK the role of AI is evolving to address both defensive and adversarial applications. AI’s double-edged role in cybersecurity is shaping the future of digital security in the UK.

UK Government to Ban Public Bodies from Paying Ransoms to Hackers: The Cyber Security Battle

UK Government to Ban Public Bodies from Paying Ransoms to Hackers: The Cyber Security Battle

On the 22nd of July, the UK government published its plans to crack down on cyber criminals who use ransomware. In a move designed to strengthen national cyber resilience and reduce the growing threat of ransomware attacks, the government plans to ban public bodies from paying these ransoms. The decision comes after a surge in cyber incidents targeting schools, councils, hospitals, and other vital services, with millions of pounds being lost to criminal groups each year. In 2023 alone, over $1 billion was lost to ransom attacks worldwide.

Navigating Cybersecurity In a Rapidly Evolving Digital Landscape

Navigating Cybersecurity In a Rapidly Evolving Digital Landscape

The UK has seen a sharp rise in cybercrime targeting public sector organisations over the past year, highlighting the need for stronger digital resilience and security strategies. We hosted the award-winning Public Sector Cyber Security Conference last February in London, which saw a collection of the UK’s data protection and cyber security leaders come together to explore how we can strengthen our collective readiness against cyber attacks.

The Public Sector Cyber Security Conference 2025

The Kido Nursery Ransomware Attack: How Cyber Attacks are Worsening in the UK

In the past week, it has come out that a ransomware attack on Kido Nurseries has seen critical information on 8000 children be ransomed for money. The hacker group, which is calling itself Radiant, has posted 10 profiles of children as proof. They are threatening to release more unless a ransom is paid.

This disgusting act shows just how far criminals will go to make money. It shows a complete lack of ethics and morals in Radiant, if it will target the most vulnerable people in our society.

Jaguar Land Rover Cyber Attack: Government Response & Cyber Security Lessons

Jaguar Land Rover Cyber Attack: Government Response & Cyber Security Lessons

The recent cyber attacks on Jaguar Land Rover (JLR) saw a sudden halt to operations, a strain on supply chains and serious questions being raised about resilience in an era of rising digital threats. The cyber attack is part of a broader pattern: businesses across industries are facing a worrying wave of cyber incidents. This article explores what happened at JLR, the consequences for its supply chain and production, and the UK government’s recent move to guarantee a loan of £1.5bn to help JLR stabilise its future.