Many thousands of passengers have been left out of pocket by the cyber attack on Transport for London, Sadiq Khan has admitted.
The mayor said a “big” number of people who were entitled to concessionary fares had been forced to pay for their journeys since September 1.
This includes older Londoners who will have qualified for a 60+ Oyster card – and students entitled to Zip cards.
But he pledged TfL would aim to process refunds as soon as its computer systems came fully back online – though it is understood this may take until Christmas.
Mr Khan was asked at Mayor’s Question Time by Neil Garratt, the leader of the City Hall Conservatives, to provide an update on the impact the cyber attack.
Mr Garratt said: “Something that will put even more financial pressure on Londoners who are struggling is the inability of TfL to process refunds, to issue receipts for journeys, because of the cyber attack.”
He asked the mayor: “Do you have a sense of the scale of the problem of those unpaid refunds? Do you know when the problem will be resolved? Most importantly, can you guarantee that, in the end, all of those people will get their refund?”
Mr Khan said he had been briefed on the scale of the problem earlier this week but declined to make public exactly how many people had been hit financially.
TfL has been unable to issue new 60+ Oysters or Zip cards since the cyber attack.
But it has suspended the need for an annual validation of the 60+ Oyster and is allowing expired Zip cards to be used as normal until the end of October.
Mr Khan said: “Some of the figures I can’t share publicly but … the figure is big in relation to the number of people who paid a fare but shouldn’t have paid a fare.
“TfL, when it comes to the return of normal business, are prioritising those passengers first.
“The way TfL is working is to make sure those commuters who are out of pocket can be resolved first then, as things improve, those who aren’t out of pocket but using expired Zip cards will be sorted out. That work has begun.”
The cyber attack exposed about 5,000 customer names, including email and home addresses and Oyster card refund data, to the hackers.
TfL has also been unable to issue refunds for incomplete pay-as-you-go journeys using Contactless.
Zip cards, which offer free bus travel and half-price Tube and train travel to children aged 11-15 and students aged 16-17, normally expire on September 30 and have to be renewed.
About 1.2m older Londoners have a 60+ Oyster or Freedom Pass. These offer free travel after 9am on weekdays and throughout the weekend.
A message on TfL’s website states: “You can still contact us to request a refund for your photocard via an online form, but we won't be able to process any refunds until the cyber security incident is resolved.
“It is our intention to refund customers for additional travel costs incurred while our Oyster photocard website is unavailable. However, due to the ongoing cyber security incident, refunds may need to be processed differently and we are working towards restoring the system as quickly as we can.
“Please keep a record of any additional travel costs, such as receipts, bank statements or paper tickets.”
