Liberty Bus

Liberty Bus is a bus operator headquartered in Jersey that provides public transportation services to residents and visitors. The company operates bus services that connect local communities. A key component of its service offering is a prepaid travel card system, which allows customers to load funds onto a card for use on its buses. Customers can manage their cards and add value through an online top‑up portal maintained by the operator.

The reach of Liberty Bus extends beyond Jersey, as evidenced by the 2019 data breach that affected users across two jurisdictions. This indicates that the operator’s prepaid travel card and online top‑up services are available to customers in at least one additional region besides its home jurisdiction. While specific figures on passenger volume or fleet size are not disclosed, the incident shows that the online service supports a user base spanning multiple areas. The breach was limited to the online top‑up portal, with no bank details accessed.

Upon discovering the spoof website, Liberty Bus acted quickly to shut down the fraudulent site and reported the breach to the relevant authorities within hours. The operator notified all 443 affected individuals about the compromise of their login credentials and passwords. It also engaged with the Information Commissioner’s Office and its web hosting provider to assist with the ensuing investigation. Officials acknowledged the organization’s proactive response while using the incident to highlight the broader risk of password reuse across multiple platforms. This episode demonstrates Liberty Bus’s commitment to incident management and compliance with data protection obligations.