24JUL

TfL hackers jailed five and a half years

2 min read

18:20UTC

Owen Flowers, 18, and Thalha Jubair, 20, drew five years six months each for the 2024 Transport for London hack that disabled 148 systems and cost £29 million.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyAssessed

Key takeaway

The UK's biggest cybercrime case jailed two Scattered Spider hackers over the 2024 TfL attack.

Owen Flowers, 18, and Thalha Jubair, 20, were jailed for five years and six months each at Woolwich Crown Court on Thursday 16 July for the September 2024 attack on Transport for London (TfL). The National Crime Agency (NCA) called it Britain's largest-ever cybercrime prosecution⁠¹.

The attack disabled 148 systems, exposed data on roughly 10 million passengers and cost TfL an estimated £29 million. Had it shut the network entirely, the NCA put the potential hit to the UK economy at £56 billion.

The pair bought partial employee credentials on criminal forums, then phoned the TfL IT helpdesk posing as staff to secure a password reset and a two-factor authentication (2FA) bypass. That route repeats the Scattered Spider helpdesk-social-engineering playbook, the same group whose alleged member Peter Stokes, known online as Bouquet, was arrested in Helsinki in April and now faces US extradition. The NCA called Scattered Spider "the most significant cybercrime threat to the UK in recent years" and said Flowers was still hacking US healthcare providers SSM Health and Sutter Health when arrested⁠².

Deep Analysis

In plain English

Scattered Spider is a cybercrime gang known for tricking IT helpdesks into resetting passwords, rather than hacking computer code directly. In September 2024 members of the group attacked Transport for London (TfL), the body that runs London's buses, Tube and trains, knocking out 148 of its computer systems and exposing personal data belonging to 10 million passengers. On 16 July a British court, Woolwich Crown Court, sentenced two of the people responsible, Owen Flowers and Thalha Jubair, to five years and six months in prison each. The National Crime Agency, the UK's equivalent of the FBI, called it the country's biggest-ever cybercrime prosecution.

Deep Analysis

Root Causes

TfL's exposure traces to a structural identity-verification gap: Scattered Spider's playbook targets IT helpdesk password-reset procedures, impersonating employees by phone to bypass multi-factor authentication rather than breaking any cryptographic control.

The scale of disruption, 148 systems and 10 million passenger records, reflects how deeply helpdesk-issued credentials cascade through a large public-sector network once initial access is gained, a dependency structure common to sprawling legacy transport IT estates.

Escalation

Flowers was arrested while separately attacking two more US healthcare providers, SSM Health and Sutter Health, showing the wider Scattered Spider collective kept operating despite the conviction of two known members.

What could happen next?

Precedent
The case establishes UK prosecutorial capacity to convict Scattered Spider members domestically rather than relying solely on US extradition requests.
Risk
Flowers' arrest while breaching two more US healthcare providers indicates the wider Scattered Spider collective kept operating despite the conviction of two known members.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2021 Colonial Pipeline ransomware attack disrupted US fuel critical infrastructure and pushed Washington to issue new mandatory pipeline cybersecurity directives within weeks. TfL's 2024 attack followed a similar arc: a financially motivated criminal crew disrupting a critical transport operator, followed by law enforcement using the case to press for a new legal power that did not previously exist in UK statute.

Counter-parallel: Unlike Colonial Pipeline, where the attacker was a ransomware-as-a-service operation later disrupted through US Justice Department action against its infrastructure, Scattered Spider's members are individually prosecutable under ordinary UK criminal law because they operate as identifiable people rather than an anonymous affiliate platform, which is why this case produced a conviction rather than an infrastructure takedown.

Consensus view: Mandiant, which tracks the group as UNC3944, holds that Flowers' and Jubair's convictions confirm the helpdesk-impersonation and SIM-swap playbook works: TfL's 148 disabled systems and 10 million exposed passenger records came from social engineering, not a code exploit, meaning the sentencing addresses only the two individuals caught.

Counter-view: ENISA's work on affiliate-based cybercrime models notes membership in loose collectives like Scattered Spider is fluid and geographically distributed, so a five-year sentence for two members may do little to reduce overall attack volume if new recruits can run the same playbook.

Key tension: Whether custodial sentencing of individual operators meaningfully deters a crime model built on interchangeable, loosely affiliated members.

Sources:National Crime Agency

Mentions:Peter Stokes →ENISA →Helsinki →London →Mandiant →Washington →FBI →Transport for London →Scattered Spider →National Crime Agency →Department of Justice →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

National Crime Agency· 24 Jul 2026

Read original →

Causes and effects

Caused by

Police press for a 'digital prison'

City of London Police's push for Cyber Crime Risk Orders is a direct domestic policy response to the TfL sentencing.

Occurred 16 Jul 2026

Read story →

This Event

TfL hackers jailed five and a half years

Britain's largest cybercrime prosecution puts custodial numbers on the helpdesk-social-engineering method Scattered Spider has exported across sectors.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.