AIBRIEF
Two teenagers who live streamed a 16 hour cyber attack on Transport for London (TfL), the public body that runs the Tube and Oyster card system, have been sentenced to five years and six months each.
Two teenagers who live-streamed a 16-hour cyber-attack on Transport for London (TfL), the public body that runs the Tube, buses and the Oyster card system, have each been sentenced to five years and six months at Woolwich Crown Court. Owen Flowers, 18, and Thalha Jubair, 20, both pleaded guilty in June to the August 2024 attack as part of Scattered Spider, a loose collective of young English-speaking hackers.
The intrusion opened with a phone call. The two teens rang TfL's IT help desk, impersonated an employee, and convinced one worker to reset that employee's password. Sixteen hours later, 148 of TfL's systems were inoperable, the personal data of millions of customers was exfiltrated, and every one of TfL's roughly 27,000 staff had to reset their passwords in person. TfL estimates the incident at around £29m (roughly $37m at 2026 exchange rates) in cost and £10m (about $13m) in lost income.
The case is closed; the control surface that made it work is not. UK National Crime Agency deputy director Paul Foster says Scattered Spider is now "heavily degraded and disrupted", but the gang was broken by arrests, not by help desks being fixed. The same phone-based impersonation trick that walked one worker past one reset still sits in every IT help desk in the country.