Two members of the notorious Scattered Spider hacking collective just earned themselves five-and-a-half years each in a UK prison. Thalha Jubair and Owen Flowers were sentenced on July 16 after pleading guilty in June to charges stemming from a major cyberattack on Transport for London, the agency that keeps one of the world’s largest cities moving.
What happened at Transport for London
The attack unfolded over four days, from August 31 to September 3, 2024. Jubair and Flowers gained high-level unauthorized access to TfL’s internal systems, triggering disruptions that affected Oyster cards and contactless payment systems.
The breach exposed personal data belonging to roughly 7 million users. The financial toll was staggering. TfL estimated the attack caused £39 million in direct damages and lost revenue. The transit authority was forced to isolate systems and implement emergency security measures just to stop the bleeding.
Court records revealed the pair livestreamed portions of their attack via Telegram.
