Customer Success - The Go-Ahead Group Fights Off Cyber Attack

Oct 22, 2026

Uploaded by Mimi

Customer success story about The Go-Ahead Group plc addressing a UK bus and train network slowdown caused by a cyber attack. After Symantec identified the situation, Threatscape deployed an engineer on site, detected the Conficker worm, and contained a system-wide threat within 24 hours. The engagement also enabled central remote management with daily scans, expanded device visibility to tens of thousands of previously undocumented endpoints across 340 locations, and delivered an estimated 10% cost reduction in 36 months through centralized governance and operational simplification.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages3

Reading Time8 min

AccessFree to download

Organization Profile

Key Challenges

Solution

Benefits

An Unexpected Source of Trouble

Two-Part Solution: Mend and Defend

Centralizing Control

CUSTOMER SUCCESS The Go-Ahead Group plc. The Go-Ahead Group Fights Off Cyber Attack and Supports a Billion Passenger Journeys a Year with Solutions from Symantec and Threatscape When a network critical to bus and train service in the UK began to slow down, the IT team at The Go-Ahead Group plc. suspected a cyber attack, and turned to Symantec and Symantec Platinum Partner Threatscape. Results include a malicious worm identified and contained on thousands of devices within 24 hours, a new central remote management capability that conducts daily scans to identify new and unprotected devices, and an estimated 10 percent cost reduction in 36 months. Rising risk for transport titan Something was wrong. The network was slowing to a crawl, and much was at stake. Thousands of buses and trains were in the middle of routes that total 250,000 miles each day for The Go-Ahead Group plc, one of the UK’s biggest transport providers. Go-Ahead operates eight bus and three train companies throughout the central and southern UK, supporting a billion passenger journeys a year. On this day, however, computer services that support the routes were slowing down, and the risk of disruption was growing. Go-Ahead called Symantec, and on Symantec’s recommendation, they called Threatscape, a Symantec Platinum Partner and endpoint specialist. An executive at Go-Ahead wanted to know what was happening to the networks. There was an attack, he said, and why wasn’t Symantec Endpoint Protection software stopping it? Threatscape immediately sent an engineer on site, and he detected that computers were under relentless attack by the Conficker worm, a form of malicious code that uses various encryption and stealth techniques to mask its spread across a network. First identified in 2008, Conficker has infected an estimated three million computers worldwide.“Network communication was getting saturated,” says Mick Legge, Head of Information Security for The Go-Ahead Group. ORGANIZATION PROFILE [Site:](Site: www.go-ahead.com)[ www.go-ahead.com](Site: www.go-ahead.com) [Industry:](Industry: Transport)[ Transport](Industry: Transport) Headquarters: London, UK Employees: 26,000 KEY CHALLENGES The Go-Ahead Group needed to identify and remove a cyber threat slowing a network that is critical to its bus and train companies. SOLUTION Go-Ahead turned to Symantec and Symantec Platinum Partner Threatscape for help with Symantec™ Endpoint Protection and Symantec™ Client Management Suite. BENEFITS • Elimination within 24 hours of system-wide worm threatening to disrupt critical network • Identification and protection of thousands of previously undocumented devices in 340 locations from central console • Daily automated scans identify new and unprotected devices • Cost reduction with a wide range of business benefits such as centralization, consolidation, and simplification CUSTOMER SUCCESS | The Go-Ahead Group plc. “Threatscape helped us triage the problem, get the Conficker worm off infected systems, and protect each device with Symantec Endpoint Protection. Within two hours, we knew exactly what was going on, and within 24 hours, we basically put out all the fires.” John Jordan IT Infrastructure Manager The Go-Ahead Group plc. An unexpected source of trouble The engineer determined that the problem wasn’t Symantec Endpoint Protection, which was successfully defending every system it was installed on.“The problem was that the network contained many undocumented and unprotected systems,” Legge explains.“People had connected systems to the network and not told Go-Ahead about them, or they hadn’t been properly registered.” The unprotected systems didn’t seem like computers, Legge adds. They lacked keyboards, but had processors and Windows operating systems embedded, making them vulnerable.“They control digital displays, sell tickets, operate the ticket gates, and power the public address system,” says Legge.“The people t

FAQs

What cyber issue affected The Go-Ahead Group’s bus and train network?

The network slowed down due to relentless attacks from the Conficker worm, a type of malicious code spreading across the network.

How quickly was the Conficker worm contained?

The worm was identified and contained on thousands of devices within 24 hours, according to the results described.

What did the solution add beyond stopping the infection?

It introduced centralized remote management with daily automated scans and deeper inventory to identify previously undocumented and unprotected devices across many locations.

Oct 22, 2026

Uploaded by Mimi