I should loop this into the thread as it may well be relevant later: https://www.bbc.co.uk/news/articles/c62z8k14kxxo
Although it only mentions TfL, they're also implicated in M&S and a metric ton of other breaches.
Including potentially JLR -- the LAPSUS$ guys were trying to start their own home brew ransomware at the time but weren't very good at it.