West Midlands Railway sent staff fake bonus email in cyber-security test

West Midlands Railway said it regularly ran exercises to test its cyber-security

A train company has been criticised for a "cynical and shocking stunt" after it promised staff a bonus in what was actually a cyber-security test.

West Midlands Trains (WMT) emailed staff to tell them they would get a financial reward for their "hard work" during the Covid pandemic.

But if staff clicked the link for more information they received a second email explaining "this was a test".

A union described it as "crass and reprehensible behaviour".

WMT said the first message was designed to mimic tactics used by criminal gangs to try to get a company's data.

Manuel Cortes, general secretary of the Transport Salaried Staffs' Association (TSSA) union, said the firm could have used any other security test.

He called on the operator to apologise and deliver on the bonus to staff who "have made real sacrifices these past 12 months".

"In that way the company can begin to right a wrong which has needlessly caused so much hurt," he said.

TSSA claimed the email had been sent to 2,500 employees.

• Latest news for the West Midlands

The operator, which runs West Midlands Railway and London Northwestern Railway, said it took cyber-security seriously and regularly ran test exercises.

"This important test was deliberately designed with the sort of language used by real cyber criminals but without the damaging consequences," a spokesman added.