Transport for London (TfL) said that its Oyster cards are secure, that personal information is kept separate from journey information and that anyone caught using a cloned card would be prosecuted.
The system is checked every 24 hours and the best any Oyster criminal could get is a day's free travel, the company claimed.
Radboud researcher Wouter Teepe presented evidence on the crack to the Dutch parliament, which has already delayed installation of a €1bn automated payment transport system based on the same core technology.
At the heart of an Oyster card is the Mifare chip, made by Philips spin-off NXP.
Designed in the 1990s before processors of that size could handle strong encryption, Mifare has suffered at least three published cracks, according to security experts who have urged TfL to upgrade the system.
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
.png&w=100&c=1&s=0)
iTnews Executive Retreat - Security Leaders Edition
Personetics Executive Forum 2026 — Sydney
Personetics Executive Forum 2026 — Auckland
Can Testing Keep Up? Quality in the Age of Accelerating Delivery
.png&w=120&c=1&s=0){kind=logo}
HPE Networking Day Sydney
