The database, which was not password-protected, was discovered online by researcher Jeremiah Fowler from consultancy firm Security Discovery. Found on an unsecured Amazon Web Services storage platform, the database appears to have been created between November 28 2019 and February 12 2020.<\/p>\n

The affected stations included major travel hubs such as London Bridge, as well as commuter hot-spots such as Chelmsford, Burnham and Norwich.<\/p>\n

Fowler said that his research suggested hackers could search the database via username, allowing them to spot individual travel journeys whenever the Wi-Fi connection was completed.<\/p>\n

According to the BBC, Fowler alerted C3UK to the breach as soon as it was discovered, but the company took nearly a week to reply. C3UK said that the exposed database, which it claims was a back-up copy, was secured as soon as it had been drawn to their attention.<\/p>\n

“To the best of our knowledge, this database was only accessed by ourselves and the security firm and no information was made publicly available,” it said.<\/p>\n

“Given the database did not contain any passwords or other critical data such as financial information, this was identified as a low-risk potential vulnerability.”<\/p>\n

C3UK added that it would not be informing the Information Commissioner’s Office (ICO) about the breach as the data had not been stolen or accessed by any other party.<\/p>\n