Scattered Spider Hackers Sentenced for £29 Million TfL Cyberattack
Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, have each been sentenced to five years and six months in prison following their involvement in a cyberattack on Transport for London (TfL) that resulted in an estimated £29 million in damages. The two members of the Scattered Spider hacking collective pleaded guilty just before their trial was set to begin. They were charged under Section 3ZA of the Computer Misuse Act, which addresses unauthorized acts that cause significant risk of serious damage.
Between August 31 and September 3, 2024, Jubair and Flowers gained unauthorized access to TfL's systems, affecting 148 systems and forcing all 27,000 employees to reset their passwords in person. The attack disrupted vital services, including the Dial-a-Ride booking system for disabled and elderly passengers, digital payments, and the rollout of contactless ticketing. The incident also rendered applications for children's discounted travel cards unavailable. Investigators noted that a complete outage of London's transport network could have cost the UK economy up to £56 billion.
Security Minister Dame Angela Eagle remarked on the case, emphasizing the serious threat cybercriminals pose to national security and infrastructure. Flowers was arrested on September 6, 2024, while he was also linked to attacks on two US healthcare organizations. A search of his home revealed evidence of the cyberattack, including laptops and a video of Jubair accessing TfL's systems. Both men were arrested at their homes on September 16, 2024. Flowers later faced additional charges for breaching bail conditions, while Jubair was charged for refusing to provide investigators with access to seized devices.
The National Crime Agency's Deputy Director, Paul Foster, stated that Scattered Spider represents a significant cybercrime threat to the UK, and this investigation has disrupted that threat and brought key offenders to justice. The group is known for its social engineering tactics, including vishing and bypassing multi-factor authentication through various methods such as SIM swapping and phishing.
