INDUSTRY FACT FILE · RAILWAYS, METRO & SURFACE TRANSPORT

Threat Landscape: Top Cyber Threats Facing Railways, Metro and Surface Transport

The 18 most relevant cyber threats, attacks and industry challenges for Indian Railways and its PSUs, metro corporations, state transport, tolling and transit technology companies, and the impact each one has on safety, services, revenue and trust.

Transport operators attract ransomware groups because services cannot stop without immediate public impact; state-backed and hacktivist actors because railways and metros are critical infrastructure and symbols; fraudsters because ticketing and tolling move enormous volumes of small payments; and bots and scalpers because popular trains sell out in seconds. The attack surface spans legacy and modern signalling, operations control centres, supplier-hosted apps, station networks, passenger information systems, national-scale ticketing APIs and roadside toll equipment.

Landmark incidents show the pattern. San Francisco's Muni (2016) had around 2,000 systems locked and opened its gates. Iran's railways (July 2021) saw false delay and cancellation notices on station displays. Denmark's DSB (October 2022) stopped trains for hours when supplier Supeo took its servers offline after an attack. Poland (August 2023) saw unauthorised radio-stop signals halt trains. Transport for London (2024) spent about £29 million recovering from an intrusion that exposed Oyster refund data. Pittsburgh Regional Transit (December 2024) lost light rail service for a day to ransomware. In India, a December 2022 data leak at the RailYatri platform led to suspension of its booking facility and a penalty, as the government told Parliament.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by transport segment (Codec Networks assessment).

4.1 Signalling, control and safety systems

Kavach, electronic interlocking, CBTC and operations control centres are being networked, maintained by OEMs and connected to diagnostics. Poland's radio-stop incidents and research on rail protocols show that cheap tools can disrupt trains, while a compromised maintenance laptop can reach the relay room.

• Questions to test: Are signalling and control networks isolated from station IT? Are OEM sessions brokered and recorded? Are maintenance ports and laptops controlled? Is cyber risk inside the safety case and the CRS/CMRS process?
• Relevant services: OT architecture assessment, segmentation, OEM access brokering, OT monitoring, cyber in safety management.

4.2 Supplier-hosted operations

DSB's trains stopped because one supplier's driver app went down. Operators increasingly run crew apps, fare systems and telecom through vendors whose incidents become the operator's outage.

• Questions to test: Which supplier systems can operations not run without? Do contracts carry recovery objectives? Are offline fallbacks defined and rehearsed? Is supplier health monitored?
• Relevant services: supplier criticality mapping, third-party programme, contractual recovery objectives, joint exercises.

4.3 Ticketing platforms at national scale

With around 89 per cent of reserved tickets online and launch-time demand concentrated into seconds, bots, scalpers and API abuse translate directly into public anger and fraud. Breaches at ticketing partners have already drawn government action in India.

• Questions to test: Are APIs authenticated, rate-limited and tested for authorisation flaws? Is bot management in place? Are payment flows tokenised and PCI DSS-aligned? Are booking patterns monitored for fraud?
• Relevant services: API and mobile testing, bot and fraud resistance, PCI DSS readiness, SOC fraud analytics.

4.4 Passenger information and crowd safety

Displays, PA and apps are the operator's voice. Iran's 2021 incident showed how false messages create chaos; at an Indian interchange in peak hour, a false evacuation message is a safety event.

• Questions to test: Are passenger information systems segregated from office IT? Is content approval enforced? Can stations override quickly? Is there a crisis communication playbook?
• Relevant services: communications and station network review, content and access controls, crisis communication exercises.

4.5 Detection, reporting and the 6-hour clock

CERT-In requires reporting within six hours; NCIIPC expects protected-system owners to report; listed PSUs disclose quarterly. Stations, OT and suppliers are usually unmonitored.

• Questions to test: Are stations, OCCs and enterprise IT monitored 24x7? Do we see supplier sessions? Is there a playbook combining safety decisions, degraded-mode operation, CERT-In reporting and public communication?
• Relevant services: IT/OT SOC, playbooks, joint drills with operations, suppliers and communications teams.

• CERT-In: incidents reported within six hours of noticing them.
• NCIIPC: incidents affecting notified protected systems require coordination and reporting by the CISO.
• Commission of Railway Safety and CMRS: incidents affecting signalling, control or safe operation trigger investigation and may affect certification.
• RBI, NPCI and card schemes: payment incidents engage scheme rules, tokenisation requirements and PCI DSS obligations.
• SEBI LODR: listed PSUs disclose cyber incidents quarterly.
• DPDP and contracts: passenger and employee data incidents trigger breach intimation from May 2027; operator and partner contracts require notification.

• Could a supplier's outage or compromised account stop our trains or buses?
• Are signalling, Kavach, CBTC and control centre networks isolated and their maintenance access controlled?
• Would our ticketing or toll platform survive a bot attack at launch time?
• Could someone push a false message to our displays and PA?
• Do we have offline fallbacks and tested backups for operations and ticketing?
• Could we detect, contain and report an incident within six hours while keeping passengers safe and informed?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and official statements.