Ransomware took Northern's £17m ticket-machine network offline two months in

In July 2021, Northern — the government-operated train company for northern England — confirmed that its brand-new self-service ticket machine estate had been knocked offline by a suspected ransomware cyber-attack. The system had been down since the previous week, with an investigation under way alongside supplier Flowbird.

The timing was brutal: only two months earlier, Northern had installed 621 touch-screen machines across 420 stations at a cost of £17m. The operator said it took 'swift action' with Flowbird, that only the servers operating the machines were affected, and that customer and payment data had not been compromised. Flowbird said its cyber monitoring identified the problem first and that it triggered a major incident procedure to protect the rest of the network.

Customers were told to buy tickets on the app or website in advance and collect them from ticket offices, or board booked services and deal with conductors — workarounds that pushed the load back onto staff and paper. Northern apologised for 'any inconvenience' and said it was working to restore normal operation as soon as possible.

The incident landed on an operator already under special measures: Northern had been taken over by the government in 2020 after a series of problems, including a timetable change that produced widespread delays and cancellations.

The £17m machine network offline; self-service ticketing suspended across 420 stations in northern England; no revenue-loss figure disclosed

The £17m rollout created 621 identical, networked touchpoints at once — a convenience upgrade and a single large attack surface deployed simultaneously.

The machines sat on server infrastructure separate from core rail systems, which contained the blast radius but also meant the marquee investment was the piece that went dark.

It compounded an operator's recent history: government takeover in 2020 after timetable chaos, now a headline cyber failure on a flagship modernisation.

New infrastructure is most exposed in its first months: a fresh, uniform fleet of connected machines is a single target, so incident response has to ship with the rollout.

As of the July 2021 report the investigation with Flowbird was ongoing, with the machine network offline and no restoration date given. Northern said normal operation would resume 'as soon as possible'; no figures were ever published for downtime length or lost revenue.