Metro system disruptions are a big concern due to their impacts on safety, service quality, and operating efficiency. A better understanding of system performance and passenger behavior under unplanned disruptions is critical for efficient decision making, effective customer communication, and identifying potential improvements. However, few studies explore disruption impacts on individual passenger behavior, and most studies use manually collected survey data. This study examines the potential of using automated collection data to comprehensively analyze unplanned disruption impacts. We propose a systematic approach to evaluate disruption impacts on system performance and individual responses in urban railway systems using automated fare collection (AFC) data. We develop a set of performance metrics to evaluate performance from the perspectives of train operations, information provision (communication), and bridging strategy (shuttle bus services to connect stations impacted by a disruption). We also propose an inference method to quantify the individual response to disruptions (e.g. travel or not, change stations or modes) depending on their trip characteristics with respect to the location and timing of the disruption. The proposed approach is demonstrated using data from a busy metro system. The results highlight the ability of AFC data in providing new insights for the analysis of unplanned disruptions, which are difficult to extract from traditional data collection methods. The case study shows that the disruption impacts are network-wide, and the impacts on passengers continue for a significant amount of time after the incident ended. The behavior highlights the importance of real-time information and the need for timely dissemination.