Loading story…
Two UK men linked to Scattered Spider, Thalha Jubair and Owen Flowers, were jailed after admitting their roles in the 2024 cyberattack on Transport for London (TfL), a breach prosecutors said gave them the highest privileged access in TfL’s environment. Investigators said the intrusion began when a co-conspirator socially engineered the TfL help desk into resetting authentication to a device controlled by the attackers, allowing them to create a domain administrator account and move through 148 systems. Authorities said the attackers stole data relating to about 7 million people and accessed information from TfL’s Oyster refunds system.
The breach disrupted customer-facing services including Dial-a-Ride, concessionary travel cards, digital payments and Oyster-related systems, and forced 27,000 employees to reset passwords in person while TfL shut systems down to contain the attack. Prosecutors said the hackers could have caused catastrophic disruption across London’s transport network; the incident ultimately cost TfL tens of millions of pounds, with reported losses and recovery costs ranging from £29 million to £39 million. Jubair received five and a half years in prison, while Flowers received five and a half years for the TfL attack alongside additional hacking offences involving two US healthcare providers; the National Crime Agency said the convictions significantly degraded Scattered Spider’s operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Thalha Jubair and Owen Flowers were sentenced to five years and six months in prison for the 2024 cyberattack on Transport for London. UK authorities described them as leading members of Scattered Spider and said the case was the UK's largest cybercrime prosecution, with the arrests and convictions materially degrading the group's operations.
In June, Thalha Jubair and Owen Flowers pleaded guilty over the TfL cyberattack. The Guardian reports the plea preceded sentencing for the intrusion and related offenses.
On 2024-09-16, the City of London Police and the UK National Crime Agency arrested Thalha Jubair and Owen Flowers in connection with the 2024 Transport for London cyberattack. The arrest marked a distinct law-enforcement action preceding their later guilty pleas and sentencing.
During the 2024 intrusion, TfL shut systems down to contain the breach, public-facing services were disrupted, and all 27,000 staff had to reset passwords in person. Authorities said 148 systems were affected and data from about 7 million people, including Oyster refunds data, was exposed.
Between 2024-08-31 and 2024-09-03, attackers linked to Scattered Spider gained highly privileged access to Transport for London after a co-conspirator allegedly tricked the TfL help desk into resetting authentication to an attacker-controlled device. Prosecutors said they created a domain administrator account and reached the core of TfL's environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberscoop.com
Open sourcecybersecuritynews.com
Open sourcecysecurity.news
Open sourcetechcrunch.com
Open sourcelinkedin.com
Open sourcenationalcrimeagency.gov.uk
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two men, **Thalha Jubair** and **Owen Flowers**, pleaded guilty under the UK Computer Misuse Act for their roles in the 2024 cyberattack on **Transport for London (TfL)**, an intrusion investigators linked to the **Scattered Spider** cybercrime ecosystem. Authorities said the attackers accessed TfL’s network between **31 August and 3 September 2024**, disrupting Oyster refund processing, temporarily affecting children’s and young people’s photocard applications, and forcing all **28,000** employees to reset passwords in person after trust in internal identity systems was lost. The breach is reported to have affected about **10 million** customers and caused losses and recovery costs estimated between **£29 million and £39 million**. The National Crime Agency, City of London Police, British Transport Police, and regional officers said a lengthy investigation produced digital evidence including screenshots showing connectivity to TfL infrastructure, videos of system access during the intrusion, Telegram communications, and activity on an online collaboration platform. Investigators also alleged that Flowers was linked to intrusions involving U.S. healthcare organizations including **SSM Health** and **Sutter Health**. Both defendants remain in custody and are due to be sentenced in July 2026, as officials cite the case as a warning about the operational impact of cyberattacks on critical infrastructure and the growing role of young, English-speaking offenders in serious cybercrime.
Jun 29, 2026
Two British teenagers, Thalha Jubair and Owen Flowers, have pleaded not guilty to charges stemming from a cyberattack on Transport for London (TfL) in August 2024. The attack, attributed to the Scattered Spider hacking collective, caused significant disruption to TfL's online services and internal systems, impacting the agency's ability to process refunds and initially believed not to have compromised customer data. However, a later update from TfL confirmed that customer information, including names, addresses, and contact details, was exposed during the breach. Both suspects were arrested by the UK National Crime Agency and City of London Police, and the charges they face are among the most severe under English law for cyber offenses, carrying a maximum sentence of life imprisonment. In addition to the TfL incident, Owen Flowers faces further charges for allegedly conspiring to attack the networks of SSM Health Care Corporation and Sutter Health in the United States, while Thalha Jubair is also charged with refusing to provide device passcodes to investigators. The U.S. Department of Justice has unsealed a complaint against Jubair for related computer crimes. The case highlights the international scope of the investigation and the serious legal consequences for those accused of high-impact cyberattacks targeting critical infrastructure and healthcare organizations.
Jun 29, 2026
Tyler Robert Buchanan, a 24-year-old British national from Dundee, Scotland, pleaded guilty in U.S. federal court in California to **conspiracy to commit wire fraud** and **aggravated identity theft** for his role in Scattered Spider’s large-scale social-engineering operation. Prosecutors said Buchanan and co-conspirators ran SMS phishing campaigns from September 2021 to April 2023 that impersonated corporate IT help desks and labor providers, used fake login pages and stolen credentials, and carried out SIM swapping to breach companies and individuals. The Justice Department said the scheme stole at least **$8 million in virtual currency** from U.S. victims across telecommunications, technology, cloud communications, outsourcing, gaming, and cryptocurrency sectors. Investigators tied Buchanan to the 2022 **0ktapus** campaign, which used fake Okta login pages to compromise more than 130 organizations, including **Twilio** and **Cloudflare**, and enabled downstream attacks affecting other major brands. Authorities said stolen credentials were funneled into a Telegram channel administered by Buchanan and an associate, and searches of his residence in Scotland uncovered victim company files, personal data, and roughly 20 devices. Buchanan was arrested in Palma de Mallorca by Spanish authorities, extradited to the United States, and has been in federal custody since April 2025; he now faces up to 22 years in prison, underscoring continued law-enforcement pressure on the loosely organized Scattered Spider group, an offshoot of **The Com**.
Jun 29, 2026