LNER (London North Eastern Railway) experienced a data breach due to unauthorized access to files managed by its third-party supplier, Merkle (a subsidiary of Dentsu). The breach compromised customer contact details and some journey history, though no bank, payment card, or password data was exposed. LNER warned customers about potential unsolicited communications and paused some customer communications as a precaution. Meanwhile, Dentsu confirmed that the breach also affected its current and former employees, exposing sensitive data such as bank/payroll details, salaries, National Insurance numbers, and personal contact information. Dentsu engaged cybersecurity firms and law enforcement, offering affected employees credit and dark-web monitoring services. The incident remains under investigation, with notifications sent to impacted parties in compliance with legal requirements. The breach highlights vulnerabilities in third-party vendor security and the broader risks of supply-chain cyberattacks.

LNER, a major UK train operator running services from London to Edinburgh, suffered a cybersecurity breach via a third-party supplier. Hackers gained unauthorized access to its customer communication database, stealing the names and email addresses of thousands of passengers. While no payment card details, passwords, or account information were compromised, the breach exposed customers to potential phishing and scam messages. The company’s core operations, including train services and ticketing, remained unaffected. LNER reported the incident to authorities (ICO, NCSC, British Transport Police, and the Department for Transport) and is working with the supplier to implement enhanced security measures. Customers were advised to stay vigilant against suspicious communications and maintain strong password practices. The breach follows a series of high-profile cyberattacks in the UK, including those on Jaguar Land Rover, Marks & Spencer, and Harrods.

LNER, a UK government-owned rail operator, confirmed that an unauthorized third party accessed customer data via one of its suppliers. The breach exposed customer contact details and partial journey history, though no financial (bank/payment card) or password information was compromised. The stolen data could be weaponized for targeted phishing or follow-on identity-based attacks, as warned by LNER and cybersecurity experts. While the immediate impact is limited to non-critical personal information, the incident highlights risks tied to third-party vendor vulnerabilities. LNER advised customers to remain vigilant against unsolicited communications but did not mandate password resets, emphasizing general password hygiene as a precaution. Security analysts stressed the need for organizations to map data flows to third parties and deploy identity threat detection to mitigate risks from such exposures.