INDUSTRY FACT FILE · RAILWAYS, METRO & SURFACE TRANSPORT

Five New Case Studies in Rail and Surface Transport Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in railways, metros, tolling and transit technology organisations and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Driver App That Stopped the Trains 3.  Case Study 2: The Ticketing API Nobody Rate-Limited 4.  Case Study 3: The Station Displays That Lied 5.  Case Study 4: The Toll Plaza Payment Diversion 6.  Case Study 5: The Engineering Laptop on the Interlocking Network

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in transport with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, NCIIPC's critical-sector expectations, railway and metro safety regimes, RBI and NPCI payment rules, SEBI disclosure for listed PSUs and DPDP.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Driver App That Stopped the Trains	Regional rail operator	Supplier outage halting operations	CERT-In; safety regime; contracts	B9, B10, B7
2. The Ticketing API Nobody Rate-Limited	Railway ticketing PSU	Bots and API abuse on a booking platform	CERT-In; DPDP; SEBI LODR	B2, B7, B6
3. The Station Displays That Lied	Metro rail corporation	Hijacked passenger information system	CMRS; CERT-In; NCIIPC	B3, B9, B10
4. The Toll Plaza Payment Diversion	Highway toll concessionaire	Business email compromise of settlement flows	NPCI/RBI; CERT-In; lender covenants	B10, B7, B2
5. The Engineering Laptop on the Interlocking Network	Railway division	Malware reaching signalling maintenance systems	CRS; NCIIPC; CERT-In	B1, B3, B9

The signals were green. The trains did not move.

At a glance
Organisation	A regional rail operator (“Railco A”) running suburban and inter-city services
Threat	Ransomware at a supplier hosting the crew and driver information app, which the supplier took offline, leaving drivers without speed restriction and work-zone data
Why it is new	Operators increasingly run safety-relevant information through vendor-hosted apps
Codec Networks services	Supplier programme, joint exercises, SOC (Bundles B9, B10, B7)

The scenario

Railco A's drivers received daily speed restrictions, work-zone notices and rosters through a supplier-hosted app. The supplier was hit by ransomware on a Saturday morning and shut its servers to contain it.

Railco A's rules did not permit departure without the current restriction data. With no offline fallback and no printed procedure, services stopped across the network for most of the day.

Operations resumed only after the supplier rebuilt its platform. The safety regulator asked for a review, and the operator discovered its contract carried no recovery time objective and no right to audit.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• No supplier criticality map: nobody had classed the app as operationally critical.
• No offline fallback for safety-relevant information.
• Contract silent on recovery objectives, security and audit rights.
• No monitoring of supplier health or access.

The impact

Railco A lost a day of services, faced regulator and media scrutiny, reported the incident to CERT-In and re-tendered the service with security and recovery requirements.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• Railway safety regime: operating rules and regulator review of the stoppage.
• Contracts: supplier security, recovery and notification obligations the contract lacked.

How Codec Networks would help

Need	Codec Networks response	Bundle
Map and govern suppliers	Supplier criticality mapping, security assessment and contractual recovery objectives	B9
Rehearse the outage	Joint tabletop and degraded-mode drills with critical suppliers	B10
Watch supplier health	SOC monitoring of supplier access and availability	B7

Key lessons Classify supplier systems operations cannot run without. Keep offline fallbacks for safety-relevant information. Put recovery objectives and audit rights in contracts. Exercise with suppliers before the outage.

Tickets sold out in eleven seconds. Most went to machines.

At a glance
Organisation	A listed railway ticketing PSU (“Ticketco B”) launching a new booking app
Threat	Bots exploiting an unauthenticated mobile API with no rate limits to reserve launch-time seats, and predictable booking identifiers leaking passenger details
Why it is new	Launch-time demand turns weak APIs into fraud and public failure at national scale
Codec Networks services	API and mobile testing, SOC fraud analytics, DPDP (Bundles B2, B7, B6)

The scenario

Ticketco B launched a new app ahead of the festive season. Its mobile API accepted booking requests without device attestation or rate limits, and bot operators reserved seats on popular trains within seconds of opening.

Fraudulent agents resold confirmed tickets at a premium while genuine passengers saw 'sold out' and complained on social media. Researchers then found that booking identifiers were sequential and returned passenger names and contact details to anyone who asked.

Ticketco B throttled the API under pressure, reported the incident, answered a privacy query and redesigned the platform during its busiest weeks.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No pre-launch API and mobile security testing.
• No rate limiting, bot management or device attestation.
• Broken object-level authorisation on booking identifiers.
• No fraud analytics on booking patterns.

The impact

Ticketco B suffered public anger, revenue leakage to resellers, a CERT-In report, a quarterly disclosure and an expensive redesign.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• DPDP: passenger data exposed through the API.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test before launch	API and mobile security testing, bot resistance, authorisation checks	B2
Watch the bookings	SOC fraud analytics and bot pattern detection	B7
Protect passengers	DPDP programme and data minimisation in APIs	B6

Key lessons Test APIs and apps before every launch. Rate-limit, attest devices and manage bots. Authorise every object reference. Monitor booking patterns for automation.

The evacuation message was fake. The crowd surge was real.

At a glance
Organisation	A metro corporation (“Metroco C”) operating three lines through a major interchange
Threat	A phished IT contractor account used to push false delay and evacuation messages to platform displays and public address at peak hour
Why it is new	Passenger information systems are reachable from office IT and rarely treated as safety-relevant
Codec Networks services	Segregation and access controls, contractor programme, crisis exercises (Bundles B3, B9, B10)

The scenario

A hacktivist group phished a contractor who maintained Metroco C's passenger information system from the corporate network. The content server accepted changes from any authenticated user without approval.

At evening peak, false messages announced service suspension and told passengers to evacuate the interchange. Crowds surged towards exits before station staff could override the displays, which required a call to the contractor.

Several passengers were injured in the crush. Metroco C reported the incident, faced a safety inquiry and spent weeks restoring confidence in its announcements.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Passenger information system on the corporate network with contractor access.
• No content approval workflow or integrity checks.
• No fast manual override at stations.
• No crisis communication playbook for false information.

The impact

Metroco C faced injuries, a safety inquiry, a CERT-In report, public criticism and a programme to segregate and control its information systems.

The regulatory lens

• Metro Railways Act and CMRS: incident affecting safe operation investigated.
• CERT-In Directions: incident reported within six hours.
• NCIIPC: coordination where systems are notified as protected.

How Codec Networks would help

Need	Codec Networks response	Bundle
Segregate and control	Segmentation of passenger information systems, access control and content integrity	B3
Govern contractors	Contractor access brokering, MFA and assessment	B9
Rehearse the crisis	Crisis communication and crowd-scenario tabletops	B10

Key lessons Treat passenger information as safety-relevant. Approve content and verify its integrity. Give stations an instant override. Rehearse false-information scenarios.

The plazas collected every rupee. The money went somewhere else.

At a glance
Organisation	A toll concessionaire (“Tollco D”) operating four plazas on a national highway
Threat	A compromised finance manager mailbox used to send 'updated' settlement bank details to the acquiring partner, diverting FASTag settlements
Why it is new	Settlement flows run on trust between concessionaires, acquirers and lenders
Codec Networks services	BEC simulation, SOC monitoring, payment flow testing (Bundles B10, B7, B2)

The scenario

Attackers phished Tollco D's finance manager and watched the mailbox for weeks, learning the settlement cycle with the acquiring bank.

They sent a genuine-looking request to update settlement bank details. The acquirer's checks were manual, and daily settlements flowed to the attackers' account for several days before reconciliation flagged the gap.

Tollco D recovered part of the money, breached a lender reporting covenant and faced questions from the highway authority.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No MFA on finance mailboxes and no mailbox-rule monitoring.
• No call-back verification or dual control for bank-detail changes.
• Reconciliation ran weekly, not daily.
• Finance staff untrained on BEC.

The impact

Tollco D lost several days of settlements, strained its lender and authority relationships and rebuilt its payment verification and monitoring.

The regulatory lens

• NPCI NETC rules and RBI expectations: settlement integrity and participant controls.
• CERT-In Directions: incident reported within six hours.
• Concession and lender covenants: revenue reporting and protection duties.

How Codec Networks would help

Need	Codec Networks response	Bundle
Train and rehearse	BEC simulation and finance team training	B10
Watch for abuse	Monitoring of mailbox rules, bank-detail changes and settlement anomalies	B7
Harden the flows	Payment flow and plaza system security testing	B2

Key lessons Verify every bank-detail change by call-back. Enforce MFA and monitor mailbox rules. Reconcile settlements daily. Train finance teams on BEC.

Every signal went to danger. The trains ran on paper.

At a glance
Organisation	A railway division (“Divco E”) with electronic interlocking at forty stations
Threat	A signalling contractor's infected laptop connected to an interlocking maintenance port, spreading malware to diagnostic and data-logger systems in relay rooms
Why it is new	Maintenance ports and contractor devices bypass every boundary the division thought it had
Codec Networks services	OT assessment, segmentation, contractor programme (Bundles B1, B3, B9)

The scenario

During maintenance, a contractor connected a personal laptop to an electronic interlocking maintenance port to download logs. The laptop carried self-spreading malware.

The malware reached diagnostic terminals and data loggers across several stations through a maintenance network that also connected to station IT. The interlocking kept trains safe by holding signals at danger, but services ran on paper authority at low speed for two days.

Cleaning the network and verifying every system took a week. The division reported to CERT-In and the Commission of Railway Safety, and an audit found flat networks between station IT and signalling maintenance systems.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Maintenance ports unlocked and unmonitored.
• Contractor devices unscanned and unsegmented.
• Flat networks between station IT and signalling maintenance.
• No OT monitoring of engineering activity.

The impact

Divco E faced two days of degraded operations, a safety report, a CERT-In report and a programme to segment and monitor its signalling maintenance estate.

The regulatory lens

• Railways Act and CRS: incident affecting safe operation reported and reviewed.
• NCIIPC: signalling and control identified as CII.
• CERT-In Directions: incident reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess the estate	Signalling and OT assessment with safety-aware methods	B1
Segment and lock	Zone-and-conduit segmentation, maintenance port control, monitoring	B3
Control contractors	Contractor device policy, scanning and access governance	B9

Key lessons Lock and monitor maintenance ports. Scan and segment contractor devices. Separate station IT from signalling maintenance. Monitor engineering activity in OT.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com