UK train operator LNER (London North Eastern Railway) discloses a data breach

UK train operator LNER (London North Eastern Railway) disclosed a data breach that occurred through a third-party supplier, exposing customer contact details and information about past journeys, according to LNER. The organisation said the breach involved unauthorised access to files managed by the third party and did not affect bank information, payment card details or passwords. It also noted that train operations and ticket sales were not impacted.

Customers are advised to be cautious of phishing attempts in unsolicited messages requesting personal information and to not respond if unsure. Security Affairs notes the disclosure was published on 12 September 2025. The company did not provide technical details about the attack or name the impacted supplier.