Experts Call for Stronger Cybersecurity Framework in Urban Rail Systems

New Delhi, India (Metro Rail Today): A major power blackout on April 28, 2025, brought metro services in Spain and Portugal to a standstill, disrupting operations of hundreds of trains and stranding lakhs of passengers across Madrid, Barcelona, and Lisbon. The unprecedented failure — though not linked to a cyberattack — has reignited global discussions on the cybersecurity preparedness of urban rail systems, including those in India.

According to official reports, 230 trains of Metro de Madrid were operating when the blackout struck, affecting over 1.5 lakh passengers. Around 44 trains halted inside tunnels, triggering large-scale rescue operations. In Barcelona, 122 metro trains — including 19 inside tunnels — were impacted, leaving 20,000 commuters stranded underground. Similarly, Lisbon Metro’s 33 trains came to an abrupt halt, stranding more than 10,000 passengers.

A Wake-Up Call for Modern Metro Systems

At the UITP India Urban Rail Conference 2025, held in New Delhi, experts underscored the urgent need for robust cybersecurity frameworks and energy resilience in metro operations worldwide.

While investigations confirmed that the blackout was not a result of a cyberattack, digitalisation and interconnected rail technologies have magnified potential vulnerabilities in critical transport infrastructure, said Suvashis Choudhary, Chief Security Commissioner and Chief Information Security Officer, Delhi Metro Rail Corporation (DMRC).

“The incident underlines why metro operators must develop a comprehensive cybersecurity framework tailored for rail systems,” Choudhary said. “There is also a need to create a centralised repository of cyber incidents to study threat patterns, identify vulnerabilities, and strengthen response mechanisms.”

Firsthand Experience from Barcelona

Jordi Picas Albets, Director of Systems, Barcelona Metro, shared a chilling account of the blackout’s immediate impact.

“We were in a meeting room when the lights went off at 12:33 pm,” Albets said. “Soon after, we realised that the entire Barcelona Metro network had lost power — the real crisis had begun.”

He added that 43 people were trapped in elevators, and mobile communication networks were down. “We focused on evacuation and operational recovery, relying on mobile radio for coordination. Within two hours, the network was fully evacuated. On average, each train took 51 minutes to be cleared — the longest, 1 hour and 42 minutes, involved assisting a passenger with reduced mobility.”

DMRC Leads Global Dialogue on Cyber Preparedness

Anuj Dayal, Principal Executive Director (Corporate Communications), DMRC, noted that the conference served as a global platform for sharing insights, best practices, and emergency response strategies among metro operators and technology experts.

“The conference hosted by Delhi Metro facilitated meaningful dialogue on managing cyber threats and enhancing safety protocols across global metro systems,” Dayal said.

DMRC also confirmed that data collected during the event will be analyzed to identify vulnerabilities, threat trends, and countermeasures for strengthening India’s metro cybersecurity posture.

Offering an Indian industry viewpoint, Mrs. Mamta Shah, MD & CEO, Urban Infra Group, highlighted that cybersecurity must evolve into a core operational discipline for India’s expanding metro ecosystem.

“The blackout in Europe is a powerful reminder that digital resilience is as critical as physical safety in modern metro systems,” Mrs. Shah said. “As India’s metro network grows rapidly, integrating cybersecurity at every level — from signalling systems to passenger information networks — is essential to safeguard commuter trust and ensure uninterrupted, reliable public mobility.”

Expert Insight: Cybersecurity Priorities for India’s Metro Systems

1. Centralised Cyber Incident Repository: Establish a unified platform for metro corporations nationwide to record, track, and analyse cyber incidents in real time.

2. Built-in Digital Defence Architecture: Incorporate cybersecurity at the design stage of metro systems — not as an add-on — covering SCADA, signalling, and passenger data networks.

3. Continuous Risk Audits & Training: Mandate periodic cyber audits and staff training to identify vulnerabilities and strengthen incident response capabilities.

The April 28 blackout stands as a wake-up call for urban transport systems worldwide. As India advances toward smart, interconnected metros, cyber resilience will be the cornerstone of ensuring public safety, operational continuity, and digital trust in the cities of tomorrow.