Loading story…
Owen Flowers, 18, and Thalha Jubair, 19, have been charged in the UK for their alleged roles in the August 2024 cyberattack on Transport for London (TfL). The attack caused significant disruption to TfL's systems, exposed data of 5,000 Oyster cardholders, and resulted in millions in losses. Both suspects are alleged members of the Scattered Spider cybercrime group and face additional charges related to attacks on US healthcare organizations and refusal to provide device passwords.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Two teenagers charged over the August 2024 cyberattack on Transport for London entered not-guilty pleas in court. The plea hearing marked a new stage in the prosecution following the charges announced in September 2025.
Subsequent reporting identified the UK teen defendant as a core figure in Scattered Spider's operations. Additional coverage said federal investigators tied the duo to approximately $115 million in ransom proceeds and described one suspect spending extortion bitcoin on games and meals.
Las Vegas police arrested a male teenager who surrendered to the Clark County Juvenile Detention Center in connection with the 2023 cyberattacks on MGM Resorts and Caesars Entertainment. He was booked on charges including extortion, conspiracy, computer crime, and misuse of another person's personally identifiable information.
The U.S. Department of Justice announced charges against a United Kingdom national in connection with multiple cyberattacks, including attacks affecting critical infrastructure. Reporting on the case said prosecutors tied Scattered Spider actors to roughly $115 million in ransom and extortion proceeds and alleged a breach of a U.S. court system.
The UK National Crime Agency announced that two teenagers had been charged in connection with the Transport for London cyberattack. Multiple outlets reported the suspects were alleged Scattered Spider members or associates tied to a broader yearslong attack spree.
Transport for London was hit by a cyberattack later attributed in reporting and charges to alleged Scattered Spider members. Subsequent UK law-enforcement action linked two teenagers to the August 2024 incident.
Investigators and cybersecurity experts tied the 2023 intrusions against MGM Resorts and Caesars Entertainment to the Scattered Spider cybercrime group. Caesars reportedly faced a $30 million cryptocurrency extortion demand and paid about half, while MGM refused to pay and suffered weeks of outages and an estimated $110 million impact.
23 references tracked. Mallory keeps watching after this page renders.
bbc.co.uk
Open sourcebbc.co.uk
Open sourcekrebsonsecurity.com
Open sourcedatabreaches.net
Open sourcegovinfosecurity.com
Open sourcejustice.gov
Open sourcenationalcrimeagency.gov.uk
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two British teenagers, Thalha Jubair and Owen Flowers, have pleaded not guilty to charges stemming from a cyberattack on Transport for London (TfL) in August 2024. The attack, attributed to the Scattered Spider hacking collective, caused significant disruption to TfL's online services and internal systems, impacting the agency's ability to process refunds and initially believed not to have compromised customer data. However, a later update from TfL confirmed that customer information, including names, addresses, and contact details, was exposed during the breach. Both suspects were arrested by the UK National Crime Agency and City of London Police, and the charges they face are among the most severe under English law for cyber offenses, carrying a maximum sentence of life imprisonment. In addition to the TfL incident, Owen Flowers faces further charges for allegedly conspiring to attack the networks of SSM Health Care Corporation and Sutter Health in the United States, while Thalha Jubair is also charged with refusing to provide device passcodes to investigators. The U.S. Department of Justice has unsealed a complaint against Jubair for related computer crimes. The case highlights the international scope of the investigation and the serious legal consequences for those accused of high-impact cyberattacks targeting critical infrastructure and healthcare organizations.
Jun 29, 2026
Two men, **Thalha Jubair** and **Owen Flowers**, pleaded guilty under the UK Computer Misuse Act for their roles in the 2024 cyberattack on **Transport for London (TfL)**, an intrusion investigators linked to the **Scattered Spider** cybercrime ecosystem. Authorities said the attackers accessed TfL’s network between **31 August and 3 September 2024**, disrupting Oyster refund processing, temporarily affecting children’s and young people’s photocard applications, and forcing all **28,000** employees to reset passwords in person after trust in internal identity systems was lost. The breach is reported to have affected about **10 million** customers and caused losses and recovery costs estimated between **£29 million and £39 million**. The National Crime Agency, City of London Police, British Transport Police, and regional officers said a lengthy investigation produced digital evidence including screenshots showing connectivity to TfL infrastructure, videos of system access during the intrusion, Telegram communications, and activity on an online collaboration platform. Investigators also alleged that Flowers was linked to intrusions involving U.S. healthcare organizations including **SSM Health** and **Sutter Health**. Both defendants remain in custody and are due to be sentenced in July 2026, as officials cite the case as a warning about the operational impact of cyberattacks on critical infrastructure and the growing role of young, English-speaking offenders in serious cybercrime.
Jun 29, 2026
Two UK men linked to **Scattered Spider**, Thalha Jubair and Owen Flowers, were jailed after admitting their roles in the 2024 cyberattack on **Transport for London (TfL)**, a breach prosecutors said gave them the **highest privileged access** in TfL’s environment. Investigators said the intrusion began when a co-conspirator socially engineered the TfL help desk into resetting authentication to a device controlled by the attackers, allowing them to create a **domain administrator** account and move through 148 systems. Authorities said the attackers stole data relating to about **7 million people** and accessed information from TfL’s Oyster refunds system. The breach disrupted customer-facing services including **Dial-a-Ride**, concessionary travel cards, digital payments and Oyster-related systems, and forced **27,000 employees** to reset passwords in person while TfL shut systems down to contain the attack. Prosecutors said the hackers could have caused catastrophic disruption across London’s transport network; the incident ultimately cost TfL tens of millions of pounds, with reported losses and recovery costs ranging from **£29 million** to **£39 million**. Jubair received **five and a half years** in prison, while Flowers received **five and a half years** for the TfL attack alongside additional hacking offences involving two US healthcare providers; the National Crime Agency said the convictions significantly degraded Scattered Spider’s operations.
Jul 18, 2026