UK Police Arrest Two Scattered Spider Hackers Over London Transport Breach

UK law enforcement agencies have arrested two individuals linked to the notorious Scattered Spider cybercriminal group.

The arrests, announced on Tuesday, pertain to a sophisticated attack on London’s transport systems.

Authorities say the suspects infiltrated critical infrastructure networks, demanding ransom payments and causing widespread disruption.

Details of the Arrests and Charges

On Sept. 16, officers from the City of London Police, West Midlands Police, and the UK’s National Crime Agency arrested 19-year-old Thalha Jubair of London and a second, unnamed suspect.

Both are accused of conspiring to commit unauthorized computer access, extortion, and money laundering.

Investigators allege the pair used social engineering and phishing techniques to breach networks managed by Transport for London (TfL), encrypt sensitive data, and demand ransom to prevent its public release.

A complaint unsealed in the US District Court for New Jersey reveals Jubair’s broader role in at least 120 intrusions worldwide. US prosecutors charge him with computer fraud, wire fraud, and money laundering conspiracies.

According to the complaint, he and his associates extorted over $115 million in ransom payments from 47 US-based victims, including critical infrastructure providers and the federal court system.

The Justice Department highlighted the group’s technical sophistication and global reach, calling the attacks a major threat to stability and security.

The successful arrests underscore growing collaboration between UK and international agencies. The FBI’s Cyber Division provided investigative support, sharing threat intelligence and forensic analysis.

“No cybercriminal is beyond our reach,” stated Brett Leatherman, Assistant Director of the FBI’s Cyber Division.

The agency worked alongside the UK’s National Crime Agency, West Midlands Police, City of London Police, the Dutch National Police, Romanian law enforcement units, the Royal Canadian Mounted Police, and the Australian Federal Police.

In July 2024, law enforcement seized a server linked to Jubair that held approximately $36 million in cryptocurrency.

Despite attempts to conceal funds, including transferring $8.4 million to alternate wallets, investigators tracked and froze assets. Authorities credit persistent cross-border cooperation for these breakthroughs.

Transport for London confirmed it discovered unauthorized access in early 2025 and immediately activated its incident response plan.

Passenger services and ticketing systems experienced intermittent outages, prompting TfL to deploy contingency measures and notify affected customers.

 While no evidence suggests passenger safety was directly compromised, officials warn of the growing risk ransomware poses to public infrastructure.

Cybersecurity experts say this case highlights the importance of robust defenses, routine network monitoring, and employee training to recognize phishing attempts.

“Scattered Spider’s tactics show how social engineering can provide footholds for deep network intrusion,” said an industry analyst.

The arrests send a clear message that coordinated law enforcement action can disrupt even the most elusive cyber threat groups.

Jubair faces up to 95 years in prison if convicted in the US, while UK courts will determine the penalties for offenses committed on domestic soil.

Both suspects remain in custody pending extradition proceedings and further court hearings. Authorities emphasize that these charges are allegations; all defendants are presumed innocent until proven guilty.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.