Other customer data including names and contact details had been accessed, it added.
The NCA, which is investigating the cyberattack alongside TfL and the National Cyber Security Centre, said a 17-year-old male had been arrested in the central English town of Walsall and later released on bail.
"We ... are working at pace with our partners to progress the investigation," Shashi Verma, TfL’s Chief Technology Officer said in a statement, adding that it was taking measures to improve security, including an all-staff IT identity check.
Verma said TfL did not expect any significant impact to customer journeys but that some temporary disruption was possible.