Transport for London

Summary

Transport for London suffered a cyber intrusion carried out by members of the Scattered Spider group that disrupted online services, disabled information boards and compromised customer data, leading to an estimated £39 million in losses and affecting around ten million individuals. The breach accessed the Oyster refunds system and halted the children’s photocard application, while investigators recovered evidence linking the attackers to the attack through seized devices and online communications. Two suspects pleaded guilty and were each sentenced to five and a half years in prison, with additional arrests and extraditions targeting other alleged members of the group.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The cyber attack on Transport for London began on 31 August 2024. Transport for London confirmed the ongoing cyber security incident on 1 September 2024 and stated it had taken immediate action to prevent further access while working with relevant government agencies. Initially the authority said there was no evidence that customer data had been compromised. Subsequent investigation revealed that the breach exposed personal information of approximately ten million customers, including names, email addresses, home and mobile phone numbers and physical addresses. The stolen database contained nearly fifteen million lines of data, some of which were duplicates. Transport for London’s online services and information boards were disrupted for three months, leaving customers unable to see certain information displays. Specific systems affected included the Oyster refunds system, the customer refund system and the application system for Oyster photocard for children and young people. The incident resulted in financial losses of £39 million for Transport for London.

Investigators from the National Crime Agency linked the intrusion to the online criminal group known as Scattered Spider. Thalha Jubair, aged twenty, and Owen Flowers, aged eighteen, were arrested at their home addresses on 16 September 2024 as part of a joint operation with the City of London Police. Seized equipment from Flowers’ residence included laptops, desktop computers, hard drives and USB devices; one laptop displayed a screenshot showing connectivity to Transport for London infrastructure and videos appeared to show Jubair accessing Transport for London systems during the attack. The pair communicated via Telegram and an online collaborative workspace, and Flowers was found to have accessed an online tool selling breached credentials. Both individuals initially pleaded not guilty but changed their pleas to guilty when the trial commenced in June 2026, admitting to conspiring to commit unauthorised acts against Transport for London under the Computer Misuse Act; Flowers also pleaded guilty to attempting to hack systems belonging to Sutter Health and SSM Healthcare Corporation. On 15 July 2026 each was sentenced to five years and six months imprisonment, a penalty described by officials as the largest cybercrime prosecution ever brought before the United Kingdom courts.

Following the guilty pleas and sentencing, the National Crime Agency stated that although other cybercriminals might continue to use the damaged Scattered Spider brand, its action against Jubair and Flowers had effectively halted the group’s criminal activity. Independent assessment supported this view, with Microsoft confirming that the arrests materially degraded the group’s ability to continue conducting cybercriminal operations. Authorities continued to pursue other suspected members; an alleged member, nineteen‑year‑old Peter Stokes, a dual United States‑Estonian national, was recently extradited to the United States to face charges. Tyler Buchanan, a British national believed to be part of the gang, pleaded guilty in a United States court in April 2026. Transport for London notified affected customers by sending emails to 7,113,429 individuals with an email address registered to their account; the messages achieved a 58 % open rate. The authority also wrote to thousands of customers to inform them of the unauthorised access to some personal information.

Sources

Sources available to members: 5 sources.