According to bustimes.org there are currently 7 vehicles out on route N18 in the middle of the afternoon. One of them is actually on 469 and the others on 308. 16 buses are shown currently on N15! Most of the buses actually operating on 56 are shown as 301.
I suspect that the problems with the bustimes.org maps are more widespread than I first thought. Of course I have no idea whether the issues are present in what they take (from BODS?) or in what BODS (?) is getting from TfL. It doesn’t appear to be the vehicle identifiers or the actual location, just (!) the attribution of buses to routes and I’m struggling to think how that can have happened. LVF is getting the route right, of course, but I appreciate that the sources they use are not necessarily identical. The misattribution to routes makes it look as if one operator is running on another’s routes, double deckers on single deck routes (hopefully no low bridges!) but don’t rush out to take photos - it is not real.
Oh, and on a small sample the routes now affected were fine before the cyberattack.