A Nigerian couple living in Dartford, England, have been sentenced to three years and nine months each in prison after orchestrating what a judge described as the worst data breach in the history of Transport for London — using stolen personal information from over 100 TfL workers to file hundreds of fraudulent tax refund claims.
Luciana Akanbi, who had worked in TfL’s HR department since 2017, exploited her insider access to harvest the private records of 107 staff members, including National Insurance numbers and passport details.
Together with her husband, Femi Akanbi, she used the stolen data to file false tax rebate claims with His Majesty’s Revenue and Customs (HMRC), the United Kingdom’s tax authority.
Investigating officers found that the pair used 38 different computer devices to funnel nearly £433,000 from the public purse through a complex money-laundering network, as part of a fraud totalling £650,000.
The scale and brazenness of the scheme set it apart from typical financial fraud.
Staff members whose data was harvested faced significant disruptions to their personal credit ratings and were forced to undergo rigorous investigations by tax authorities to clear their names — a secondary ordeal that compounded the harm inflicted on the victims.
An investigator noted that the breach created an atmosphere of profound distrust within the HR department where Luciana Akanbi had worked.
In response to the case, TfL moved swiftly to overhaul its data security infrastructure.
Richard Mullings, TfL’s Head of Counter-fraud and Corruption, confirmed that the organisation had introduced more stringent multi-factor authentication for database access and real-time monitoring of employee activity on sensitive servers to identify unusual patterns of data retrieval.
As the Akanbis begin their sentences, the Home Office is expected to review their immigration status, as the judge noted their potential liability for deportation.
The case has drawn widespread attention as a cautionary tale about the risks posed by insiders with privileged access to sensitive employee data — a threat that cyber security experts say remains significantly underestimated across public sector organisations.
Analysts say the Akanbi case underscores the urgent need for transport authorities and other government bodies to move beyond perimeter-based security and implement robust monitoring of internal data access, particularly within human resources and payroll departments where large volumes of personal data are routinely processed.