Two Scattered Spider Members Sentenced for TfL Hack
Summary
Two Scattered Spider members pleaded guilty and each received five years and six months in prison for the 2024 TfL hack, which disrupted services and exposed customer data. TfL reported £29 million in losses and recovery costs.
Key points
- Thalha Jubair and Owen Flowers each received five years and six months in prison after pleading guilty under the Computer Misuse Act.
- The 2024 intrusion disrupted TfL systems and services, including digital payments, contactless ticketing, and Dial-a-Ride.
- TfL said 148 systems were knocked offline and 27,000 employees had to reset their passwords in person.
- TfL disclosed that customer names, addresses, and contact details were stolen.
- TfL reported £29 million in losses and recovery costs; officials estimated wider economic damage could have reached £56 billion if the transport network had been shut down.
- Investigators linked Flowers to attempted intrusions against U.S. healthcare organizations; the article also reports separate U.S. charges against Jubair tied to at least 120 network breaches.
Article Details
- Event Type
- Two members of Scattered Spider were sentenced to five years and six months in prison each for the 2024 cyberattack on Transport for London.
- Impact
- The breach disrupted TfL systems and services, including payments and contactless ticketing; 148 systems became inoperable and 27,000 employees had to reset passwords in person. Customer data was stolen. TfL reported £29 million in losses and recovery costs; officials estimated potential UK economic damage of up to £56 billion if the transport network had been shut down.
People
Threat Actors
Owen FlowersScattered Spider member who pleaded guilty to the TfL hack and was sentenced to five years and six months in prison. Investigators said he was also in the process of hacking U.S. healthcare companies when arrested.Scattered SpiderCybercrime collective whose members were convicted for the 2024 attack on TfL; investigators also linked members to other attacks, including attacks against U.S. healthcare organizations and UK retailers.Thalha JubairScattered Spider member who pleaded guilty to the TfL hack and was sentenced to five years and six months in prison. The U.S. Department of Justice also charged him in September 2025 in connection with at least 120 network breaches.