{"id":1044782,"date":"2026-06-23T10:27:21","date_gmt":"2026-06-23T10:27:21","guid":{"rendered":"https:\/\/www.europesays.com\/uk\/1044782\/"},"modified":"2026-06-23T10:27:21","modified_gmt":"2026-06-23T10:27:21","slug":"two-scattered-spider-hackers-plead-guilty-over-transport-for-london-cyberattack","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/uk\/1044782\/","title":{"rendered":"Two Scattered Spider hackers plead guilty over Transport for London cyberattack"},"content":{"rendered":"

Two members of the notorious hacker group Scattered Spider have pleaded guilty to charges related to a 2024 cyberattack on Transport for London (TfL)<\/a> that resulted in \u00a329 million in loss and recovery costs.<\/p>\n

\"Transport<\/p>\n

Thalha Jubair, 20, from London, and Owen Flowers, 18, from Walsall, pleaded guilty at a court hearing in London to offences under the UK\u2019s Computer Misuse Act<\/a> and will be sentenced on July 16.<\/p>\n

TfL, the public body responsible for much of the capital\u2019s transport network, handles up to 5 million passenger journeys a day on the London Underground alone.<\/p>\n

The attack targeted TfL\u2019s computer network between 31 August and 3 September 2024.<\/p>\n

\u201cData from TfL\u2019s Oyster refunds system was accessed and the incident also affected TfL\u2019s customer refund system, leaving some out of pocket for much longer than usual. It also closed down the application system for Oyster photocards for children and young people,\u201d the National Crime Agency (NCA) said.<\/p>\n

Following the compromise of its network, TfL required all 28,000 employees to attend an office in person to reset their passwords.<\/p>\n

Jubair and Flowers were arrested at their home addresses on 16 September 2025 by officers from the NCA and the City of London Police. Flowers was first arrested on September 6, 2024, as part of the TfL investigation.<\/p>\n

Investigators uncovered evidence linking Flowers to intrusions targeting U.S. healthcare providers SSM Health and Sutter Health. Officers seized several devices from his home, including laptops, desktop computers, hard drives and USB storage devices.<\/p>\n

One laptop contained a screenshot showing connectivity to TfL infrastructure, while another contained videos recorded by Flowers that showed Jubair accessing TfL systems during the attack. The evidence showed the pair communicating via Telegram and an online collaboration platform used to share access and information.<\/p>\n

Flowers later breached his bail conditions on two occasions in 2025.<\/p>\n

\u201cThis has been a lengthy, highly complex and painstaking investigation,\u201d said<\/a> Deputy Director Paul Foster, head of the NCA\u2019s National Cyber Crime Unit.<\/p>\n

\u201cCyber crime may appear faceless and distant compared to other crime types, but the infiltration of TfL\u2019s systems shows it has real-world consequences and impacts hugely on the public.<\/p>\n

\u201cThe attack caused millions of pounds in losses to a key part of the UK\u2019s critical national infrastructure, and was a significant inconvenience for customers,\u201d Foster added.<\/p>\n

\u201cThose who target critical organisations, cause substantial financial harm, and disrupt the daily lives of the public will not do so without consequence,\u201d noted Deputy Commissioner Nik Adams<\/a> of the City of London Police.<\/p>\n","protected":false},"excerpt":{"rendered":"Two members of the notorious hacker group Scattered Spider have pleaded guilty to charges related to a 2024…\n","protected":false},"author":2,"featured_media":1044783,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[7757],"tags":[748,13509,393,2000,4884,2003,257,68212,16651,16,15],"class_list":["post-1044782","post","type-post","status-publish","format-standard","has-post-thumbnail","category-london","tag-britain","tag-cybercrime","tag-england","tag-eu","tag-great-britain","tag-law-enforcement","tag-london","tag-national-crime-agency","tag-transportation","tag-uk","tag-united-kingdom"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@uk\/116798950802926469","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts\/1044782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/comments?post=1044782"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts\/1044782\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/media\/1044783"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/media?parent=1044782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/categories?post=1044782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/tags?post=1044782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}