Two Scattered Spider Members Plead Guilty to TfL Cyberattack
Summary
Thalha Jubair and Owen Flowers pleaded guilty to hacking Transport for London in 2024. The intrusion disrupted Oyster refunds, exposed customer data and caused £29 million in losses, according to the NCA.
Key points
- Jubair and Flowers changed their pleas to guilty on the first day of proceedings at Woolwich Crown Court.
- The intrusion affected TfL systems from August 31 to September 3, 2024, disrupting operations.
- Attackers accessed data from TfL's Oyster refunds system, and customer data was stolen; some refunds were delayed.
- The NCA said the incident caused £29 million in financial damage and required 28,000 TfL employees to reset their passwords.
- Investigators reportedly found evidence on seized devices, including a screenshot showing connectivity to TfL infrastructure and videos of Jubair breaching TfL systems.
- Investigators have also linked Flowers to intrusions at SSM Health Care Corporation and Sutter Health.
Article Details
- Victim Organization
- Transport for London
- Incident Type
- Cyber intrusion involving unauthorized system access, customer-data theft, and disruption of refund services
- Incident Date
- 2024-09-02
- Disclosure Date
- 2024-09-12
- Data Types Exposed
- Customer data
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Oyster refund services were disrupted, delaying refunds for some users. The NCA said all 28,000 employees had to reset their passwords and the incident caused £29 million in financial damage.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Threat Actors
Owen FlowersPleaded guilty to hacking Transport for London. Investigators also linked him to intrusions at SSM Health Care Corporation and Sutter Health.Scattered SpiderThe article identifies Jubair and Flowers as members of the group and reports that they pleaded guilty to hacking Transport for London.Thalha JubairPleaded guilty to hacking Transport for London; investigators seized videos showing him breaching TfL systems.
Industries
HealthcareIn addition to TfL, authorities have also linked Flowers to intrusions at SSM Health Care Corporation and Sutter Health, both American healthcare organizations.TransportationThe two individuals, Thalha Jubair (20) and Owen Flowers (18), breached the systems of London’s transportation service between August 31 and September 3, 2024, causing millions of pounds in losses.