Scattered Spider duo sentenced to 5 and a half years in prison over TFL hack

Two British cybercriminals belonging to the Scattered Spider hacking group, Thalha Jubair and Owen Flowers, have each been sentenced to five and a half years in prison. Their sentence follows the 2024 cyberattack on Transport for London (TfL) that cost £39 million and resulted in the theft of the personal data of 10 million customers.

The attack, which took place between 31 August and 3 September 2024, enabled the pair to gain domain administrator access, allowing them to shut down the transport network entirely. While the main tube and bus services were unaffected, the dial-a-ride service for disabled passengers was disrupted, the data of millions of commuters was stolen, and 27,000 staff members had to reset their passwords. The attack was only stopped after TfL pulled the plug on its systems.

Jubair, from London, and Flowers, from the West Midlands, communicated via Telegram and livestreamed the attack. Both were key members of the Scattered Spider hacking group and had accumulated millions in cryptocurrency. The National Crime Agency (NCA) said that the convictions have put a stop to the group's activities. 

Training Announcement: The BCS Foundation Certificate in Information Security Management Principles (CISMP) is an entry-level programme aligned with ISO/IEC 27001 and Cyber Essentials that examines the fundamental concepts, technologies and principles of information security management. It provides attendees with practical knowledge of key concepts and techniques in risk management, security operations, and technical, physical, and environmental security. In addition, CISMP addresses legal and regulatory requirements, business continuity and disaster recovery planning, and emerging technologies. Find out more.