In brief: Two British cybercriminals from the Scattered Spider group pleaded guilty to attacking Transport for London (TfL) – this is part of a growing series of arrests and convictions within the group.
Thalha Jubair (20) and Owen Flowers (18) have pleaded guilty to attacking Transport for London (TfL). The attack in August/September 2024 caused £29 million in damage and disrupted critical services.
Jubair from East London and Flowers from Walsall infiltrated TfL’s network between 31 August and 3 September 2024, disabling Station Information Boards and online services including the refund portal and Oyster Photocard application. All 28,000 employees of London’s transport authority were required to visit a TfL office to reset their passwords.
The attack exposed names, email addresses, telephone numbers and physical addresses of approximately 10 million people, as revealed by a BBC investigation in 2026. The financial damage is estimated at £29 million (approximately $38.2 million), including incident response and recovery costs.
Flowers was arrested on 6 September 2024. Forensic analysis of his devices – laptops, towers, hard drives and USB sticks – revealed he had also infiltrated systems belonging to US healthcare companies SSM Health Care and Sutter Health. A seized Acer laptop contained videos of Jubair accessing TfL systems. The pair communicated via Telegram and used shared workspaces with other cybercriminals.
The Scattered Spider group operates as a loose network of English-speaking actors and uses social engineering, help desk impersonation and SIM swapping to bypass multi-factor authentication. The duo is part of a growing wave of convictions: high-ranking member Tyler Buchanan was arrested in Spain in 2024 and pleaded guilty in 2026 to attempting to steal $8 million in cryptocurrency. Co-conspirator Noah Michael Urban from Florida received a ten-year prison sentence in 2025.
Sentencing is scheduled for 22 July and underscores the investigative effectiveness of the UK National Crime Agency and City of London Police against the group.
Source: www.csoonline.com · Published 24 June 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.1.