TfL Cyberattack: Two Scattered Spider Members Plead Guilty, Causing £29 Million in Losses
Two individuals linked to the cybercrime group Scattered Spider have admitted their involvement in the Transport for London (TfL) cyberattack, a significant breach that disrupted services, compromised customer data, and incurred losses estimated at £29 million for the transport authority. The guilty pleas were made by Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, West Midlands, during proceedings at Woolwich Crown Court. Initially set to face trial on June 22, both defendants opted to change their pleas to guilty.
Major Disruption from the TfL Cyberattack
The National Crime Agency (NCA) and City of London Police reported that TfL’s network was compromised between August 31 and September 3, 2024. This breach necessitated that all 28,000 TfL employees attend offices for mandatory password resets, leading to significant operational disruptions across the organization.
The attack also allowed unauthorized access to sensitive data within TfL’s Oyster refunds system, affecting the authority’s ability to process customer reimbursements. Additionally, the application system for Oyster photocards, utilized by children and young people, was temporarily disabled. Authorities have indicated that the financial repercussions of the attack, including losses and recovery costs, totaled approximately £29 million.
Investigation Links Attackers to Scattered Spider
Jubair and Flowers were apprehended at their residences on September 16, 2024, following a collaborative investigation by the NCA and City of London Police. Investigators identified the two as members of Scattered Spider, a cybercriminal collective known for several high-profile intrusions.
During the search of Flowers’ home, law enforcement recovered multiple devices, including laptops and USB storage. Notably, one Acer laptop contained a screenshot that indicated connectivity to TfL’s infrastructure. Furthermore, evidence suggested that Flowers had accessed an online marketplace for stolen credentials, and videos allegedly recorded by him showed Jubair accessing TfL systems during the attack.
The investigation revealed that the two communicated via Telegram and utilized an online collaboration platform that facilitated remote work on shared systems.
Additional Allegations Involving U.S. Healthcare Networks
The scope of the investigation extended beyond the TfL cyberattack. When Flowers was initially arrested on September 6, 2024, NCA officers uncovered evidence of unauthorized activities targeting the networks of SSM Health Care Corporation and Sutter Health in the United States. Court documents indicate that Flowers pleaded guilty to charges related to a conspiracy aimed at impairing operations within SSM Health Care’s computer systems. He also admitted to attempting unauthorized actions against Sutter Health’s systems.
Jubair faces an additional charge for failing to disclose PINs or passwords associated with devices seized during the investigation. Authorities noted that Flowers breached bail conditions on two occasions in March and May 2025.
Law Enforcement Highlights the Impact of Cybercrime
Paul Foster, Deputy Director and head of the NCA’s National Cyber Crime Unit, characterized the case as a lengthy and complex investigation. He emphasized that the attack underscored the significant real-world consequences of cybercrime, which can severely impact public services and result in substantial financial losses to critical national infrastructure.
Foster also pointed out the increasing threat posed by cybercriminal organizations operating from the UK and other English-speaking countries, citing Scattered Spider as a prominent example. Deputy Commissioner Nik Adams of the City of London Police remarked on the significant impact of the cyberattack on essential public services and daily operations, asserting that those responsible for targeting critical organizations would be pursued through coordinated law enforcement efforts.
The investigation received support from the West Midlands Regional Organised Crime Unit and British Transport Police. Jubair and Flowers are scheduled for sentencing at Woolwich Crown Court on July 16.
Source: thecyberexpress.com
Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.
