“In a moment of crisis, Sam did not hesitate to protect those around him,” LNER managing director David Horne said as the rail firm confirmed the injured colleague is 48-year-old customer host Samir Zitouni. British Transport Police, after viewing CCTV, called his actions “nothing short of heroic.”

Mr Zitouni remains critically unwell but stable in hospital. His family said they are “immensely proud” and that “he’s always been a hero”, thanking staff at Addenbrooke’s and his colleagues for their support. LNER said he has served on board for more than 20 years.

The attack happened on the 18:25 Doncaster to London King’s Cross service on Saturday 1 November. Police received the first calls around 19:39 and armed officers met the train at Huntingdon within minutes, making arrests eight minutes after the first 999 call. Operation Plato was initially declared and later stood down; police say there is nothing to suggest terrorism.

Passengers described panic as they moved through carriages, helping the wounded and using jackets to stem bleeding. One eyewitness told the BBC an older man stepped between the attacker and a younger girl, suffering a gash to his head and neck - an account consistent with police praise for the staff member’s bravery.

Prosecutors have charged Anthony Williams, 32, with 10 counts of attempted murder, one count of actual bodily harm and one count of possessing a bladed article in connection with the train attack. He also faces a further attempted murder and possession charge over an earlier incident at Pontoon Dock on the DLR. Williams appeared at Peterborough Magistrates’ Court on Monday 3 November, was remanded in custody and is due at Cambridge Crown Court on 1 December. A second man arrested at the scene has been released with no further action.

British Transport Police said 11 people were treated in hospital in total - ten taken by ambulance and one who self-presented. As of Tuesday 4 November, seven have been discharged. One patient, an LNER member of staff, remains stable but critically unwell, and three others are stable in hospital.

Detectives are linking other incidents from the same period: the stabbing of a 14-year-old boy in Peterborough on Friday evening, two reports of a knifeman at a Fletton barbers on Friday and Saturday, and the DLR assault. BTP has primacy for the overall investigation covering 31 October and 1 November.

Cambridgeshire’s Chief Constable Simon Megicks has ordered an internal review of events before the train attack, after a formal request from Police and Crime Commissioner Darryl Preston. The IOPC declined to investigate, but the PCC said the review’s findings should be made public.

Driver Andrew Johnson diverted the service into Huntingdon so emergency teams could board quickly. He later played down his own role, saying his colleagues on board were the “real heroes”.

Ministers and police stress the attack is not being treated as terrorism. Transport Secretary Heidi Alexander ruled out airport-style metal detectors at stations as unworkable, promising more visible BTP patrols and a security review. She noted rail crime remains rare - roughly 27 crimes per million journeys - and said the LNER staffer “left work a hero”.

BTP is appealing for witnesses or footage from the train: text 61016 quoting reference 663 of 01/11/25. LNER says services are running with extra support for customers and crew following the incident.