Two members of criminal hacking group plead guilty to £39m TfL hack

Two members of the hacking collective Scattered Spider have pleaded guilty to a cyber attack on Transport for London (TfL) that cost an estimated £39 million and disrupted services, the National Crime Agency (NCA) said. Thalha Jubair, 20, and Owen Flowers, 18, targeted TfL’s network between 29 August and 6 September 2024. The breach required 28,000 employees to reset passwords and led to access to data from the Oyster refund system, delayed some refunds, and suspended applications for children’s and young people’s Oyster photocards. They changed pleas to guilty at Woolwich Crown Court on Monday. Investigators said Flowers also targeted US healthcare firms, pleading guilty over SSM Health Care Corporation and attempting unauthorised acts against Sutter Health. The NCA reported evidence including devices, a screenshot showing TfL connectivity, and video of Jubair accessing TfL systems.