£1.8bn rail cyber scenario is mostly losses beyond Network Rail

The Department for Transport's Transport Resilience Strategy, published on 2 November, cites independent research that puts the economic cost of a systemic cyber incident on Britain's rail network at about £1.8bn over one week of disruption. Only about 7% of that falls on Network Rail directly.

The figure is not new. It comes from a KPMG report for the Department for Science, Innovation and Technology, dated April 2025 and published on 12 November 2025, which the strategy cites in a footnote.

KPMG's table gives a total economic cost of £1,801.7m in 2024 prices for a reasonable worst case in which services using Level 2 European Train Control System stop immediately and stay down for a week. Network Rail's direct financial cost is £123.5m (KPMG's summary text says £123.0m). Passengers' longer journeys account for £281.3m.

The remaining £1,397.0m is lost output, which KPMG measures as gross value added: £116.7m from lost work days, £520.1m from freight disruption and £760.1m from wider supply chain effects. KPMG names construction, cement and concrete products, and glass and ceramics as the sectors most affected by freight disruption, and says some substitution between inputs would reduce that impact.

Train and freight operators appear in the table at £0. KPMG says their contracts with Network Rail mean Network Rail would compensate them for lost revenue, and that cost sits inside the £123.5m.

KPMG rated the likelihood as low: "a low likelihood that within a 2 year period a cyber incident targeting the UK rail sector will result in systemic level impact".

CoverWire's analysis is that the scenario measures economic cost, not insured loss. About 93% of the total falls on passengers, freight customers and their suppliers rather than on the rail operator, and neither document addresses what insurance would pay. Whether any cyber or business interruption policy would respond depends on its own wording.

On resilience planning, the strategy says: "Cyber resilience and preparedness must form an integral part of that business planning."

Related coverage: Insurers warn spoilage from fridge hacks may fall outside cover; NCSC: four routes behind 88% of large-firm incidents it handled.

Sources

• Department for Transport: Transport Resilience Strategy, 2 November 2026
• KPMG for DSIT: The economic impact of a systemic cyber incident to the rail network (PDF)
• DSIT: Independent research on the economic impact of cyber attacks on the UK, 12 November 2025

CoverWire is a news and information service. Nothing here is investment advice.