A cheap radio kit. A curious 23-year-old. Three bullet trains forced to a screeching halt. That is all it took to expose serious cybersecurity gaps in Taiwan’s high-speed rail network and trigger a full anti-terrorism response. The April incident has rattled rail operators across the globe, raising urgent questions about how vulnerable our most trusted transport systems really are.
How a Student Brought Bullet Trains to a Halt
On April 5, a 23-year-old train enthusiast in Taiwan pulled off a stunt that left investigators stunned and security experts deeply worried.
Using a software-defined radio setup paired with hardware bought online, he spoofed a General Alarm signal directly to the operations center of Taiwan High Speed Rail (THSR). The control room treated it as the real thing.
Operators issued emergency braking orders to three high-speed trains running near the signal’s source. Passengers felt the sudden stop. Schedules collapsed within minutes. Normal service resumed only after a 48-minute delay.
Authorities initially feared a terrorist attack before tracing the signal back to the student’s location. He was detained within days. Reports suggest he simply wanted to test whether the railway radio system was as easy to fool as he suspected.
The TETRA Problem That Won’t Go Away
At the heart of this breach sits a radio standard called Terrestrial Trunked Radio, widely known as TETRA. It is used by police forces, military units, emergency services, and rail operators in dozens of countries.
Wouter Bokslag, founding partner of Dutch cybersecurity consultancy Midnight Blue, says the protocol can be safe if set up properly. The trouble is that many operators leave it in weak configurations.
“These technologies, the core of it definitely is old stuff, but it’s reliable,” Bokslag said. “The TETRA network, under certain conditions, can definitely be secure and could be a suitable solution here, but I suspect they were not running the strongest of configurations.”
His team has uncovered serious flaws in TETRA twice. In 2023 and again in 2025, Midnight Blue researchers revealed weaknesses that essentially left a low-security backdoor open to attackers with the right tools.
The European Telecommunications Standards Institute later released TETRA’s security algorithms for public review. That openness helps researchers spot weaknesses, but it also hands attackers more ammunition while defenders struggle to upgrade aging networks.
A Pattern of Rail Hacks Around the World
Taiwan is far from alone. Rail networks have become a recurring target for both hobbyists and serious threat actors over the past three years.
- Poland, August 2023: Hackers used a simple three-tone radio signal to halt trains across three regions for two straight days.
- Israel, September 2023: Pro-Iranian group Cyber Avengers claimed to have disrupted rail services, though Israeli officials and cybersecurity firms rejected the claims.
- United States, July 2025: CISA warned of a flaw that could allow attackers to spoof end-of-train and head-of-train devices, risking sudden stops or even derailments.
Lukasz Olejnik, a cybersecurity consultant who studied the Poland incident, says Taiwan’s case shows growing sophistication. The Polish attackers simply replayed legacy analog tones. The Taiwanese student had to understand the system deeply enough to clone parameters and inject a believable alarm.
“For Taiwan, it apparently required understanding the environment and extracting or cloning the necessary parameters to inject them to cause an alarm,” Olejnik said. “The lesson is that communication protocols add resilience only if deployed well.”
What Happens If Real Attackers Strike
So far, most rail disruptions have come from curious enthusiasts rather than organized criminals or state-backed hackers. Experts fear that lucky streak will not last forever.
Sean Tufts, field chief technology officer at operational technology security firm Claroty, paints a worrying picture. Rail systems stretch across huge geographic areas. Many run on decades-old equipment. Communication points sit in remote locations where physical and digital security often fall short.
“Getting to that last switching station in the middle of a rail line and having the right communications with it and having cybersecurity bolted around it, that is a challenge for every single rail operator in the world.” Sean Tufts, Claroty
He compares the potential fallout to the Strait of Hormuz disruption that cut global oil flows by 20%. A similar hit on US rail would ripple through manufacturing, food supply chains, and store shelves within days.
“If we had that in the United States, a 20% degradation in rail service, that would have cascading impacts into manufacturing, into goods, into food and beverage,” Tufts said. “That one singular pinch point can cause some massive disruptions.”
The Push for Better Rail Security
Fixing these gaps will not happen overnight. Vendors and system integrators sometimes give clients incorrect security advice, according to Bokslag. Operators often lack the in-house expertise to verify whether their setups are actually safe.
Olejnik puts the fix in plain terms. Rail operators must move away from unauthenticated systems and protect every safety-critical command with strong cryptography.
| Security Weakness | Recommended Fix |
|---|---|
| Unauthenticated radio commands | Cryptographic authentication for all safety signals |
| Weak TETRA configurations | Strongest available encryption and regular audits |
| Replay attack risks | Time-stamped or nonce-based message validation |
| Poor terminal control | Strict device authentication and frequent key rotation |
For passengers, the message is sobering. The trains they board every day depend on radio systems that, in some cases, were designed before modern cyber threats even existed.
The Taiwan bullet train hack lasted less than an hour, but its lessons will echo across the rail industry for years to come. One young man with cheap gear proved that critical transport networks can buckle under simple radio tricks. It is a reminder that behind every smooth journey runs a thin layer of trust between aging technology and human safety. What do you think rail operators should do first to protect passengers? Share your thoughts in the comments below.
