Loading story…
Two British teenagers, Thalha Jubair and Owen Flowers, have pleaded not guilty to charges stemming from a cyberattack on Transport for London (TfL) in August 2024. The attack, attributed to the Scattered Spider hacking collective, caused significant disruption to TfL's online services and internal systems, impacting the agency's ability to process refunds and initially believed not to have compromised customer data. However, a later update from TfL confirmed that customer information, including names, addresses, and contact details, was exposed during the breach. Both suspects were arrested by the UK National Crime Agency and City of London Police, and the charges they face are among the most severe under English law for cyber offenses, carrying a maximum sentence of life imprisonment.
In addition to the TfL incident, Owen Flowers faces further charges for allegedly conspiring to attack the networks of SSM Health Care Corporation and Sutter Health in the United States, while Thalha Jubair is also charged with refusing to provide device passcodes to investigators. The U.S. Department of Justice has unsealed a complaint against Jubair for related computer crimes. The case highlights the international scope of the investigation and the serious legal consequences for those accused of high-impact cyberattacks targeting critical infrastructure and healthcare organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Two alleged members of the Scattered Spider cybercrime group pleaded not guilty to charges tied to the cyberattack on Transport for London. Multiple outlets reported the court development as the latest major step in the case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two men, **Thalha Jubair** and **Owen Flowers**, pleaded guilty under the UK Computer Misuse Act for their roles in the 2024 cyberattack on **Transport for London (TfL)**, an intrusion investigators linked to the **Scattered Spider** cybercrime ecosystem. Authorities said the attackers accessed TfL’s network between **31 August and 3 September 2024**, disrupting Oyster refund processing, temporarily affecting children’s and young people’s photocard applications, and forcing all **28,000** employees to reset passwords in person after trust in internal identity systems was lost. The breach is reported to have affected about **10 million** customers and caused losses and recovery costs estimated between **£29 million and £39 million**. The National Crime Agency, City of London Police, British Transport Police, and regional officers said a lengthy investigation produced digital evidence including screenshots showing connectivity to TfL infrastructure, videos of system access during the intrusion, Telegram communications, and activity on an online collaboration platform. Investigators also alleged that Flowers was linked to intrusions involving U.S. healthcare organizations including **SSM Health** and **Sutter Health**. Both defendants remain in custody and are due to be sentenced in July 2026, as officials cite the case as a warning about the operational impact of cyberattacks on critical infrastructure and the growing role of young, English-speaking offenders in serious cybercrime.
Jun 29, 2026
Two UK men linked to **Scattered Spider**, Thalha Jubair and Owen Flowers, were jailed after admitting their roles in the 2024 cyberattack on **Transport for London (TfL)**, a breach prosecutors said gave them the **highest privileged access** in TfL’s environment. Investigators said the intrusion began when a co-conspirator socially engineered the TfL help desk into resetting authentication to a device controlled by the attackers, allowing them to create a **domain administrator** account and move through 148 systems. Authorities said the attackers stole data relating to about **7 million people** and accessed information from TfL’s Oyster refunds system. The breach disrupted customer-facing services including **Dial-a-Ride**, concessionary travel cards, digital payments and Oyster-related systems, and forced **27,000 employees** to reset passwords in person while TfL shut systems down to contain the attack. Prosecutors said the hackers could have caused catastrophic disruption across London’s transport network; the incident ultimately cost TfL tens of millions of pounds, with reported losses and recovery costs ranging from **£29 million** to **£39 million**. Jubair received **five and a half years** in prison, while Flowers received **five and a half years** for the TfL attack alongside additional hacking offences involving two US healthcare providers; the National Crime Agency said the convictions significantly degraded Scattered Spider’s operations.
Jul 18, 2026
U.S. prosecutors have charged 19-year-old dual U.S.-Estonian citizen Peter Stokes, allegedly a member of the **Scattered Spider** cybercrime group who used the alias `Bouquet`, after his arrest in Finland on April 10. According to reports citing court records, Stokes was detained while allegedly attempting to board a flight to Tokyo and now faces wire fraud, conspiracy, and computer intrusion charges in a sealed six-count complaint, with U.S. authorities seeking his extradition to Chicago. Investigators allege he took part in at least four intrusions, including a 2023 breach of an online communications platform and other attacks carried out while he was still a teenager. The complaint links Stokes to Scattered Spider operations that relied on help-desk social engineering, credential resets, MFA fatigue, and SMS phishing to gain access to major corporate environments. One 2025 intrusion described in the filings allegedly targeted a multibillion-dollar luxury retailer, where attackers obtained administrator access, claimed to have stolen **100 GB** of data, and issued an **$8 million** extortion demand, causing more than **$2 million** in losses. The case adds to broader law-enforcement pressure on the financially motivated group, also tracked as **Octo Tempest**, which has been tied to intrusions affecting MGM Resorts, Caesars, Twilio, Reddit, Riot Games, Mailchimp, DoorDash, Harrods, Marks & Spencer, WestJet, and Jaguar Land Rover.
Jul 3, 2026