title: "Scattered Spider hackers plead guilty in $38M TfL attack" slug: "scattered-spider-hackers-plead-guilty-in-38m-tfl-attack" published: "" beat: "Crime" tags: ["Crime", "Policy"] creator: "Agentry Newsroom" editor: "Susanne Sperling, Editor — Human in the Loop" tools: ["Claude (Anthropic)", "Perplexity Sonar"] creativeWorkStatus: "verified" dateReviewed: "2026-06-25" aiActArticle50: "compliant" humanView: "https://agentry.news/scattered-spider-hackers-plead-guilty-in-38m-tfl-attack" agentView: "https://agentry.news/agent/scattered-spider-hackers-plead-guilty-in-38m-tfl-attack"
Two members of the Scattered Spider cybercrime collective pleaded guilty on June 24, 2026 to hacking Transport for London's network, causing £29 million ($38.2 million) in damages and exposing the per
Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. AI policy.
Two members of the Scattered Spider cybercrime collective pleaded guilty on June 24, 2026 to compromising Transport for London's network between August 31 and September 3, 2024, according to CSO Online. Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, West Midlands, changed their pleas on the first day of their trial at Woolwich Crown Court.
The attack exposed the names, email addresses, mobile phone numbers, and physical addresses of an estimated 10 million people, according to a BBC investigation in March 2026. Transport for London reported total losses, incident response, and recovery costs of £29 million ($38.2 million). The breach also affected all 28,000 TfL employees whose credentials were compromised during the intrusion.
The UK's National Crime Agency and City of London Police investigated the attack. The guilty pleas came ahead of a jury trial that was scheduled to begin on the day Jubair and Flowers entered their admissions CSO Online.
Scattered Spider is known for deploying social engineering and credential-stuffing tactics to gain initial network access, then moving laterally through victim infrastructure to extract data or deploy ransomware. The collective has targeted critical infrastructure operators, financial institutions, and major corporations across multiple continents since 2022.
Sentencing for Jubair and Flowers is due to take place on July 22, 2026 at Woolwich Crown Court. The case is part of a wider international investigation into Scattered Spider. Co-conspirator Noah Michael Urban of Palm Coast, Florida, was jailed for 10 years in April 2025 after pleading guilty to aggravated identity theft and wire fraud offences connected to the group's activity.
The guilty pleas underscore law enforcement's growing ability to attribute and prosecute members of prolific cybercrime collectives, even as the group continues to operate across borders. The TfL attack represents one of the largest breaches of UK critical national infrastructure in recent years and demonstrates the operational scale Scattered Spider has achieved.