Transport for London

Between August 31 and September 3, 2024, two members of the Scattered Spider cybercrime group breached Transport for London's systems. On June 23, 2026—day one of what was expected to be a six-week trial—Thalha Jubair (20, East London) and Owen Flowers (18, Walsall) pleaded guilty to conspiracy charges including causing risk of serious damage to human welfare.

The breach crippled London's transportation authority. TfL manages the Underground, buses, Overground, DLR, and trams serving millions daily. The attack triggered an unprecedented response: all 28,000 TfL employees were required to physically attend an office location to complete mandatory password resets.

10 million people. A BBC investigation in March 2026 revealed the full scope: names, email addresses, mobile phone numbers, and physical home addresses of an estimated 10 million Transport for London users. Customer refund bank details were also exposed—anyone who requested a refund through TfL had their banking information compromised.

Oyster card data maps movement patterns across London. Where people travel, when, how frequently. Combined with home addresses and contact details, this is surveillance-grade data on 10 million Londoners—available to anyone with access to the stolen records.

Ten million Londoners and TfL users. Anyone who tapped an Oyster card, requested a refund, or created a TfL account. The exposed data enables phishing campaigns targeting London residents. Bank details enable financial fraud. Movement data enables stalking, burglary timing, or personal surveillance.

The scale is staggering. London's population is approximately 9 million—this breach affected more people than live in the city. Commuters from surrounding areas, tourists who bought Oyster cards, anyone who interacted with TfL digitally. The harm isn't hypothetical; it's 10 million individual exposures.

TfL is critical national infrastructure. It operates under government oversight with regulatory requirements for security. This isn't a startup with minimal security investment—it's the transportation backbone of a major global city.

But Scattered Spider specializes in social engineering. The group has targeted major organizations across sectors—investigators linked Flowers to additional intrusions at SSM Health Care Corporation and Sutter Health in the United States. Their playbook exploits human factors, not just technical vulnerabilities. The attackers were 18 and 20 years old.

10 million records. How much of that was active user data versus historical accumulation? Every Oyster card registration, every account created since the system launched, every refund request ever processed. Transportation systems operate for decades—the data accumulates across generations of users.

The mandatory password reset for all 28,000 employees—conducted in person—suggests TfL couldn't determine which credentials were compromised. When you can't scope the breach, you reset everything. That organizational response reveals uncertainty about what attackers accessed and what systems were affected.

£29 million in recovery costs. The UK's Information Commissioner's Office investigation. Mandatory notifications to 10 million affected individuals. The operational burden of resetting 28,000 employee credentials in person. Nearly two years from breach to conviction—and the defendants pleaded guilty on trial day one.

Sentencing is scheduled for July 16, 2026. The case demonstrates that cybercriminals can be caught and prosecuted—but the conviction doesn't undo the breach. Ten million records remain exposed. The attackers face consequences; the victims live with permanent exposure.