Two Scattered Spider Hackers Convicted Over Transport for London Cyber Attack

Two alleged members of the notorious Scattered Spider cybercrime collective have pleaded guilty to orchestrating a disruptive cyber attack against Transport for London (TfL). This marks a significant law enforcement victory against a group known for targeting large enterprises and critical infrastructure.

The UK National Crime Agency and City of London Police confirmed that Thalha Jubair, 20, and Owen Flowers, 18, admitted their roles in compromising TfL’s network during an intrusion that took place between August 31 and September 3, 2024.

The attack caused widespread operational disruption and financial losses estimated at £29 million, affecting thousands of customers who rely on essential public transportation services.

Two Scattered Spider Hackers Convicted

According to investigators, the attackers gained unauthorized access to TfL’s internal systems, which led the organization to initiate a mass password reset for approximately 28,000 employees.

The breach also exposed parts of the Oyster card refund system, resulting in delays in reimbursements and a temporary shutdown of services, including the Oyster photocard application system, used by children and young commuters.

The operational fallout highlighted how cyber intrusions into public transport systems can quickly escalate into real-world service disruptions and significant financial consequences.

Digital forensic analysis was crucial in attributing the attack to the suspects. During Flowers’ arrest in September 2024, investigators seized multiple devices, including laptops, external storage media, and USB drives.

One device contained a screenshot confirming connectivity to TfL’s infrastructure. At the same time, further evidence revealed the use of credential harvesting tools sourced from underground marketplaces.

Authorities also recovered recorded video footage showing active access to compromised TfL systems, as well as Telegram communications between the two attackers coordinating their actions in real time.

Investigators identified that the attackers used collaborative online platforms, enabling multiple threat actors to operate simultaneously within the compromised environment.

The investigation extended beyond the TfL incident and uncovered links to intrusions targeting US healthcare organizations, including SSM Health Care Corporation and Sutter Health.

This aligns with known Scattered Spider tactics, which often involve social engineering, credential theft, and lateral movement across enterprise networks to maximize impact.

The group targets high-value sectors such as telecommunications, finance, and healthcare, frequently exploiting identity-based vulnerabilities rather than traditional software flaws.

Both suspects were scheduled to stand trial at Woolwich Crown Court on June 22, 2026, but changed their pleas to guilty at the start of the proceedings. Sentencing is expected on July 16. Law enforcement officials emphasized that TfL’s prompt engagement was instrumental in enabling a successful investigation and attribution process.

Authorities also highlighted the growing threat posed by English-speaking cybercriminal groups, particularly those leveraging collaboration tools and decentralized communication channels to execute complex attacks.

This case underscores the increasing convergence of cybercrime and critical infrastructure risk, where relatively small groups of threat actors can inflict large-scale disruption.

It also reinforces the importance of incident response readiness, credential security, and proactive monitoring of unauthorized access patterns in defending against modern intrusion campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.