Scattered Spider Members Plead Guilty to 2024 TfL Cyberattack
Two members of the Scattered Spider cybercriminal group 20-year-old Thalha Jubair of East London and 18-year-old Owen Flowers of Walsall pleaded guilty on June 22, 2026, to orchestrating a major cyberattack against Transport for London (TfL) in late 2024. The admission came on the first day of their trial at Woolwich Crown Court, with sentencing set for July 16, 2026.
The breach occurred between August 31 and September 3, 2024, when the pair infiltrated TfL’s internal systems, disrupting critical services. The attack forced all 28,000 TfL employees to physically reset passwords, causing widespread operational delays. Financial losses and recovery costs totaled approximately £29 million, marking one of the most damaging cyber incidents against UK public infrastructure in recent years.
Attackers compromised TfL’s Oyster refund system, halting customer refunds and disabling the photocard application system used by children and young Londoners. Flowers was first arrested on September 6, 2024, with authorities seizing devices including an Acer laptop containing forensic evidence a screenshot of active TfL network access and screen recordings of Jubair navigating the breach. Telegram messages between the pair further confirmed their collaboration.
Investigators also linked Flowers to breaches at two U.S. healthcare organizations, SSM Health Care Corporation and Sutter Health, underscoring Scattered Spider’s transnational reach. The group, known for social engineering, SIM swapping, and ransomware, has previously targeted high-profile entities like MGM Resorts and Caesars Entertainment.
The National Crime Agency (NCA) and City of London Police (COLP) led the investigation, supported by the West Midlands Regional Organized Crime Unit and British Transport Police. NCA Deputy Director Paul Foster highlighted the attack’s real-world impact, while COL Deputy Commissioner Nik Adams credited coordinated law enforcement efforts for the conviction.
Source: https://cyberpress.org/scattered-spider-london-transport-network-breach/
Centre for Health and Disability Assessments cybersecurity rating report: https://www.rankiteo.com/company/centre-for-health-and-disability-assessments
"id": "CEN1782203081",
"linkid": "centre-for-health-and-disability-assessments",
"type": "Cyber Attack",
"date": "8/2024",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"{'affected_entities': [{'industry': 'Transportation',
'location': 'London, UK',
'name': 'Transport for London (TfL)',
'type': 'Public infrastructure'},
{'industry': 'Healthcare',
'location': 'United States',
'name': 'SSM Health Care Corporation',
'type': 'Healthcare'},
{'industry': 'Healthcare',
'location': 'United States',
'name': 'Sutter Health',
'type': 'Healthcare'}],
'attack_vector': ['Social engineering', 'SIM swapping'],
'date_detected': '2024-09-03',
'date_publicly_disclosed': '2026-06-22',
'description': 'Two members of the Scattered Spider cybercriminal group '
'pleaded guilty to orchestrating a major cyberattack against '
'Transport for London (TfL) in late 2024, disrupting critical '
'services and causing financial losses of approximately £29 '
'million.',
'impact': {'financial_loss': '£29 million',
'operational_impact': 'Widespread operational delays; forced '
'28,000 TfL employees to physically reset '
'passwords',
'systems_affected': ['Oyster refund system',
'Photocard application system']},
'investigation_status': 'Convicted',
'references': [{'date_accessed': '2026-06-22',
'source': 'Woolwich Crown Court'},
{'source': 'National Crime Agency (NCA)'},
{'source': 'City of London Police (COLP)'}],
'response': {'law_enforcement_notified': 'Yes'},
'threat_actor': 'Scattered Spider',
'title': 'Scattered Spider Members Plead Guilty to 2024 TfL Cyberattack',
'type': 'Cyberattack'}