Two Scattered Spider members plead guilty over the 2024 Transport for London intrusion
Analysis
Thalha Jubair (20) and Owen Flowers (18) changed their pleas to guilty at Woolwich Crown Court on 2026-06-22, both admitting conspiracy to commit unauthorised acts against Transport for London under the Computer Misuse Act (UK National Crime Agency, 2026-06-22; ITV News, 2026-06-22). The 31 August – 3 September 2024 intrusion disrupted TfL services for three months, forced in-person password resets for all 28,000 staff, and affected roughly 10 million customers including Oyster systems, at a cost the NCA puts at £29M in loss and recovery (ITV and the BBC reported £39M. Flowers additionally admitted attempted intrusions against US healthcare providers Sutter Health and SSM Health; the NCA ties both defendants to the Scattered Spider collective (UNC3944 / Storm-0875), and sentencing is set for 16 July 2026 (Yahoo/BBC, 2026-06-22).
Cited evidence
a total of 148 systems became inoperable, including critical ones that required significant manual workarounds and delays.
Flowers and Jubair purchased partial TfL credentials from "well-known criminal forums" and used those to reset the 2FA on employee accounts, a process that took multiple attempts.
Woolwich Crown Court heard that the pair impersonated an employee and socially engineered a TfL helpdesk worker into resetting the password for their account.
Updates1
The guilty-plea entry recorded that two Scattered Spider members admitted the 2024 TfL intrusion but did not carry the access mechanics. The 2026-07-16 sentencing (five years six months each, at Woolwich Crown Court) put the chain on the court record, and it is the reason to revisit this. The pair bought partial TfL employee credentials from criminal forums, then "impersonated an employee and socially engineered a TfL helpdesk worker into resetting the password for their account" and, over multiple attempts, reset the account's 2FA, using the reset credentials for initial and sustained access (The Register, 2026-07-16). The NCA confirmed the impact scale, "a total of 148 systems became inoperable, including critical ones that required significant manual workarounds and delays" (NCA, 2026-07-16), and TfL later established that data on roughly 7 million users had been accessible, far beyond the ~5,000 initially believed (The Register, 2026-07-16). The CPS put the remediation cost at £29 million (CPS, 2026-07-16).
Sources6
Revision history
- Published 2026-06-23-165387f6
- Update 2026-07-17T0409Z-intel
Owen Flowers and Thalha Jubair, named by the NCA and CPS as leading Scattered Spider members, were sentenced on 2026-07-16 to five years six months each for the Aug-Sep 2024 Transport for London intrusion. The new, operationally relevant delta over the June guilty-plea coverage is the court-record intrusion chain: the pair bought partial TfL employee credentials from criminal forums, impersonated an employee to vish a TfL helpdesk worker into resetting the account password and (over multiple attempts) its 2FA, then used the reset credentials as valid-account access. TfL later confirmed ~7 million users' data was accessible (not the ~5,000 first believed); 148 systems were rendered inoperable.
Changed: entities evidence sources techniques body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.