Marks & Spencer and SSM Health Care Corporation: Scattered Spider members behind TfL hack get five years in prison

Scattered Spider Hackers Sentenced for 2024 TfL Cyberattack

Two key members of the Scattered Spider cybercrime group, 20-year-old Thalha Jubair and 18-year-old Owen Flowers, were sentenced to five years and six months in prison each for their roles in the August 2024 hack of Transport for London (TfL). The attack disrupted critical services, including Dial-a-Ride, digital payments, contactless ticketing, and refund processing, while rendering 148 systems inoperable and forcing 27,000 TfL employees to reset passwords in person.

The breach, disclosed by TfL on September 2, 2024, also exposed customer data, including names, addresses, and contact details. Financial losses for TfL reached £29 million, with officials warning that a full network shutdown could have cost the UK economy up to £56 billion.

Owen Flowers was arrested on September 16, 2024, alongside Jubair, after authorities linked him to ongoing attacks on U.S. healthcare providers Sutter Health and SSM Health Care Corporation. Evidence seized from Flowers included proof of the TfL intrusion. Both pleaded guilty under the Computer Misuse Act.

The UK National Crime Agency (NCA) called Scattered Spider "the most significant cybercrime threat to the UK in recent years", crediting TfL’s early cooperation with law enforcement for the convictions. Meanwhile, the U.S. Department of Justice charged Jubair in September 2025 with conspiracy, computer fraud, money laundering, and wire fraud, alleging involvement in 120 breaches between May 2022 and September 2025, including attacks on U.S. critical infrastructure and courts. The group is accused of extorting over $115 million from global victims between August 2024 and July 2025.

In July 2025, the NCA arrested four additional suspected Scattered Spider members in connection with cyberattacks on major UK retailers, including Harrods, Marks & Spencer, and Co-op.

Source: https://www.bleepingcomputer.com/news/security/scattered-spider-members-behind-transport-for-london-hack-get-five-years-in-prison/

Marks & Spencer TPRM report: https://www.rankiteo.com/company/marks-and-spencer

SSM Health Care Corporation TPRM report: https://www.rankiteo.com/company/crossmark

"id": "marcro1784212096",
"linkid": "marks-and-spencer, crossmark",
"type": "Cyber Attack",
"date": "8/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Transportation',
                        'location': 'London, UK',
                        'name': 'Transport for London (TfL)',
                        'size': '27,000 employees',
                        'type': 'Public Transport Authority'}],
 'data_breach': {'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'Personally Identifiable Information '
                                        '(PII)',
                 'type_of_data_compromised': ['Names',
                                              'Addresses',
                                              'Contact details']},
 'date_detected': '2024-08-01',
 'date_publicly_disclosed': '2024-09-02',
 'description': 'Two key members of the Scattered Spider cybercrime group were '
                'sentenced to five years and six months in prison each for '
                'their roles in the August 2024 hack of Transport for London '
                '(TfL). The attack disrupted critical services, including '
                'Dial-a-Ride, digital payments, contactless ticketing, and '
                'refund processing, while rendering 148 systems inoperable and '
                'forcing 27,000 TfL employees to reset passwords in person. '
                'The breach also exposed customer data, including names, '
                'addresses, and contact details.',
 'impact': {'data_compromised': 'Customer data (names, addresses, contact '
                                'details)',
            'financial_loss': '£29 million',
            'operational_impact': 'Disrupted Dial-a-Ride, digital payments, '
                                  'contactless ticketing, and refund '
                                  'processing; forced 27,000 employees to '
                                  'reset passwords in person',
            'systems_affected': '148 systems inoperable'},
 'investigation_status': 'Closed (convictions secured)',
 'motivation': ['Financial gain', 'Extortion'],
 'references': [{'source': 'UK National Crime Agency (NCA)'},
                {'source': 'U.S. Department of Justice'}],
 'regulatory_compliance': {'legal_actions': 'Sentenced to five years and six '
                                            'months in prison',
                           'regulations_violated': ['Computer Misuse Act']},
 'response': {'law_enforcement_notified': 'Yes'},
 'threat_actor': 'Scattered Spider',
 'title': 'Scattered Spider Hackers Sentenced for 2024 TfL Cyberattack',
 'type': 'Cyberattack'}