Transport for London
Transport for London (TfL) is the local government body responsible for London's transport network.
Transport for London runs the capital's buses, Underground and road network. Two members of the Scattered Spider hacking group were jailed on 16 July 2026 over the 2024 breach that hit its systems, Britain's largest-ever cybercrime prosecution.
Last refreshed: 28 July 2026 · Appears in 1 active topic
TfL's 2024 breach hit 10 million passengers, so why did it take until July 2026 for anyone to be jailed?
Timeline for Transport for London
Mentioned in: ICO reprimands ACRO over patching failures
Cybersecurity: Threats and DefencesMentioned in: New Jersey sets a passenger ceiling
2026 FIFA World CupTfL hackers jailed five and a half years
Cybersecurity: Threats and DefencesPolice press for a 'digital prison'
Cybersecurity: Threats and DefencesBackground
Transport for London (TfL) is the local government body running London's buses, Underground and road network. On 16 July 2026 Woolwich Crown Court jailed Owen Flowers and Thalha Jubair, both members of the Scattered Spider hacking group, for five years and six months each over the September 2024 cyberattack on TfL's systems. The National Crime Agency called the prosecution Britain's largest-ever for cybercrime.
The 2024 attack disabled 148 of TfL's systems and exposed data belonging to roughly 10 million passengers, at an estimated cost to TfL of £29 million; the NCA separately estimated the potential hit to the wider UK economy, had the network been shut down entirely, at £56 billion.
The case has since become a platform for wider policy debate. Following the sentencing, City of London Police pressed for a new court power it called Cyber Crime Risk Orders, which would restrict a convicted hacker's access to technology after release, a model with no current basis in UK statute.