Two Men Sentenced for TfL Hack; Prosecutors Link Them to Scattered Spider

Summary

Two men received 5.5-year sentences for the 2024 TfL intrusion, which disrupted 148 systems and was estimated to cost £29 million. TfL said customer data was accessed or may have been exposed; prosecutors linked the defendants to Scattered Spider.

Key points

Owen Flowers and Thalha Jubair each received a five-and-a-half-year sentence after pleading guilty to offences connected to the 2024 TfL intrusion.
The intrusion left 148 TfL systems inoperable and disrupted transport services; the NCA and CPS put TfL’s losses and recovery costs at £29 million.
TfL said customer names and email addresses had been accessed. Oyster refund data, potentially including bank details for about 5,000 people, may also have been accessed.
The NCA described both men as leading members of Scattered Spider; the CPS said they had claimed group membership and that prosecutors believe the group carried out hundreds of attacks.
Flowers also admitted offences over attacks against SSM Health Care Corporation and Sutter Health; the NCA says his arrest stopped the activity.
The article says investigators did not establish how the attackers first accessed TfL. Guidance cited in the article recommends verifying identity during password resets, device enrollment and MFA changes.

Article Details

Event Type: Cybercrime sentencing following a major public-transport cyberattack
Impact: Owen Flowers and Thalha Jubair were each sentenced to five and a half years for the 2024 Transport for London intrusion. The attack left 148 systems inoperable and disrupted transport services. TfL said customer names and email addresses had been accessed; home addresses and data for around 5,000 Oyster refund customers, including bank account numbers and sort codes, may also have been accessed. The NCA and CPS put TfL’s losses and recovery costs at £29 million.