DfT cites £1.8bn cyber-disruption scenario for Britain’s rail network

By Amara Osei

A one-week cyber incident stopping rail communications across Britain could cost £1.8 billion in a reasonable worst-case scenario cited in the Department for Transport’s strategy published on 2 November. The number is modelled, not an observed loss, and KPMG assessed the likelihood of comparable network-wide disruption within two years as low.

What does the £1.8bn estimate cover?

On page 31 of its Transport Resilience Strategy, the DfT cited KPMG’s 2025 report, The Economic Impact of a Systemic Cyber Incident to the Rail Network. KPMG developed the reasonable worst-case model in consultation with the DfT, Network Rail and the Department for Science, Innovation and Technology. It assumes a hypothetical systemic incident and one week of disruption.

The model assigns the economic costs as follows:

• £123.5 million in direct financial costs to Network Rail.
• £281.3 million in additional journey-time costs for passengers.
• £1.397 billion in wider economic impacts, including lost productivity, disrupted freight movements and knock-on supply-chain effects.

The £1.8 billion headline equates to about £257 million for each day of the modelled outage. It is not an annual loss estimate, and most of the modelled burden arises from passenger time, lost business activity, freight disruption and supply-chain effects rather than direct Network Rail costs.

What would a systemic attack stop?

The scenario assumes a cyber incident affecting Network Rail’s train communications system and causing a loss of communications across the national rail network. Services relying on Level 2 European Train Control System (ETCS) would stop immediately and remain stopped until the system was restored.

Other services would initially operate at speeds of up to 100mph, before restrictions reduced the limit to 60mph. ETCS suspension therefore removes capacity outright, whereas the speed restriction lengthens journeys for services that continue. The DfT’s cited summary provides no restoration timetable, leaving the operational assumptions difficult to test against service data.

How likely is network-wide disruption?

KPMG assessed the likelihood of an incident causing systemic disruption within a two-year period as low. It identified the potential for an incident affecting one organisation to spread across the sector, particularly because railway systems and supply chains are interconnected.

The report also found differences in cyber security maturity between organisations. The summary assigns no numerical probability to the low assessment, so the £1.8 billion figure cannot serve as a probability-weighted annual loss estimate.

What does the strategy require?

The strategy sets out a five-to-ten-year approach and contains 22 commitments. The DfT says cyber resilience must form an integral part of transport operators’ business continuity planning. Operators must identify vulnerabilities, map critical interdependencies within their organisations, and establish response and recovery arrangements.

The department also commits to working with industry across the transport sector, including its own arm’s-length bodies, alongside the Government’s National Cyber Action Plan. Three named outputs are:

• Develop transport resilience standards.
• Establish a Transport Resilience Network.
• Launch a Transport Resilience Academy pilot to improve skills and collaboration.

These remain planned outputs rather than evidence that the modelled disruption risk has fallen, and the cited summary gives them no budget, completion date, retained-capacity measure or cost-reduction target.

Can resilience measures reduce the exposure?

The strategy does not confine resilience to cyberattack. It recognises that power outages, telecommunications failures, supply-chain disruption, extreme weather and geopolitical instability can affect transport operations. It also treats infrastructure interdependencies as a challenge because failure at one asset or organisation can have consequences across other networks and essential services.

For rail, this means continuity cannot be reduced to train control alone, since upstream power, communications and supplier failures can constrain service and extend recovery. The cited summary gives no commitment a passenger-volume, freight-capacity or cost-reduction target for the modelled week.

The next test is whether the DfT can convert the proposed standards, network and academy into measurable recovery times and retained capacity, reducing the service and cost exposure framed in the £1.8 billion scenario.