£29 million in damage and 28,000 employees forced to physically visit their offices to reset passwords. That is the cost of a four-day breach of Transport for London by two Scattered Spider members who just pleaded guilty at Woolwich Crown Court.
The Breach That Cost a City's Transit
Thalha Jubair, 20, and Owen Flowers, 18, broke into TfL systems between August 31 and September 3, 2024. They hit the Oyster refunds system, disrupting customer refund services and delaying payments for days. TfL admitted on September 12 that customer data was stolen. The UK's National Crime Agency (NCA) arrested Flowers that same day.
The financial hit: £29 million ($38.3M). Every one of TfL's 28,000 employees had to go to their local offices in person to reset passwords. That operational nightmare alone screams how deep the breach cut.
Evidence Trail from Telegram to a Shared Platform
The NCA seized devices from Flowers' home, including a laptop with a screenshot showing connectivity to TfL infrastructure and evidence of access to a marketplace selling stolen credentials. Videos showed Jubair actively breaching TfL systems. The two communicated over Telegram and a shared online collaboration platform during the intrusion.
Jubair and Flowers initially denied involvement but changed their pleas to guilty on the first day of trial. Sentencing was rescheduled from June 22 to July 16. Flowers had also breached his bail conditions twice, in March and May 2025.
What This Means for Critical Infrastructure Security
The NCA's Deputy Director Paul Foster emphasized that TfL's early engagement with law enforcement made the result possible. He urged other organizations to do the same. Beyond TfL, authorities linked Flowers to intrusions at SSM Health Care Corporation and Sutter Health, two American healthcare organizations.
Two young hackers caused £29M in damage and forced a major city's transit authority to its knees for days. The next crew might not plead guilty so quickly.
Source: Scattered Spider members plead guilty to hacking Transport for London
Domain: bleepingcomputer.com
Comments load interactively on the live page.