TWO SCATTERED SPIDER MEMBERS SENTENCED TO MORE THAN FIVE YEARS FOR £29 MILLION TRANSPORT FOR LONDON CYBERATTACK

LONDON — Two members of the cybercrime group known as Scattered Spider have been sentenced to more than five years in prison after admitting to carrying out the 2024 cyberattack against Transport for London (TfL), an intrusion British authorities say caused widespread operational disruption and approximately £29 million (about $39 million) in recovery costs.

According to the United Kingdom’s National Crime Agency (NCA), Thalha Jubair, 20, of East London, and Owen Flowers, 18, of Walsall, were each sentenced to five years and six months in prison at Woolwich Crown Court after pleading guilty to offenses under Section 3ZA of the Computer Misuse Act.

Authorities described the case as the largest cybercrime prosecution ever brought before a U.K. court and only the second prosecution under Section 3ZA of the Computer Misuse Act, one of the country’s most serious cybercrime statutes. The offense applies to unauthorized computer activity that causes—or creates a significant risk of causing—serious damage to critical infrastructure or public welfare and carries a maximum sentence of life imprisonment.

The defendants admitted to infiltrating Transport for London’s computer network during a cyberattack that disrupted internal operations, exposed customer information, and required an extensive recovery effort. Although investigators said the attackers did not succeed in shutting down London’s transportation network, the breach significantly affected day-to-day operations across the organization.

According to investigators, approximately 27,000 Transport for London employees were required to report in person to reset passwords following the intrusion. The attack also rendered 148 internal computer systems temporarily unavailable, forcing personnel to rely on manual procedures while technical teams worked to restore services.

Authorities said customer services were also affected. Data associated with Transport for London’s Oyster card refund system was compromised, resulting in delays for passengers requesting refunds. Applications for Oyster photocards used by children and young people were also temporarily suspended while systems were secured.

The National Crime Agency estimated that if the attackers had successfully disabled London’s transportation infrastructure, the economic impact could have reached approximately £56 billion (about $75.6 billion), highlighting the potential consequences of cyberattacks targeting critical infrastructure.

Investigators identified Jubair and Flowers as leading members of Scattered Spider, a loosely organized English-speaking cybercriminal group that has been linked to numerous high-profile cyber intrusions affecting organizations in the United Kingdom and the United States.

Security agencies have associated the group with attacks targeting airlines, retailers, insurance companies, telecommunications providers, technology firms, casinos, and healthcare organizations. Investigators say Scattered Spider commonly relies on social engineering, credential theft, phishing, SIM-swapping, and help desk impersonation to obtain initial network access before conducting data theft, extortion, or ransomware-related activity.

The National Crime Agency stated that coordinated arrests carried out during September 2024 significantly disrupted the group’s operations.

According to investigators, Flowers was first arrested while authorities believed he was simultaneously compromising computer systems belonging to SSM Health Care Corporation and Sutter Health in the United States. Searches conducted at his residence resulted in the seizure of laptops, desktop computers, external hard drives, and USB storage devices.

Investigators reported that one seized laptop contained a screenshot showing connectivity to Transport for London’s network. Authorities also recovered videos allegedly recorded by Flowers showing Jubair actively accessing Transport for London systems during the intrusion.

The investigation determined the pair coordinated aspects of the attack through Telegram and an online collaborative workspace.

Following his initial arrest, Flowers was rearrested after authorities alleged he violated bail conditions restricting his use of electronic devices. Jubair also faced an additional charge after investigators said he refused to disclose passwords and PINs for electronic devices seized during the investigation.

British authorities said the case underscores the growing threat posed by organized cybercriminal groups targeting critical infrastructure and demonstrates the importance of rapid reporting by victims to law enforcement agencies.

Officials are also considering additional legal measures designed to reduce repeat cyber offenses. Among the proposals are Cyber Crime Risk Orders, which would allow courts to impose restrictions on convicted cybercriminals after their release, including limitations on access to certain devices, online services, or technologies commonly used to facilitate cybercrime.

The investigation was led jointly by the National Crime Agency and the City of London Police, with assistance from the West Midlands Regional Organised Crime Unit, British Transport Police, and international partners, including the Federal Bureau of Investigation (FBI).

British authorities also confirmed that Jubair and Flowers remain under investigation in connection with separate ransomware attacks targeting Marks & Spencer, Co-op, and Harrods. No criminal charges have been filed in those investigations.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE