Scattered Spider Sentencing - 5.5 Years Each for the £39m TfL Hack: What Every UK SME Needs to Know About Social Engineering and Managed IT
Two members of Scattered Spider - Owen Flowers (18) and Thalha Jubair (20) - were sentenced to five years and six months each at Woolwich Crown Court on 16 July 2026 for the 2024 cyber-attack on Transport for London, which cost £39m, rendered 148 IT systems inoperable, forced 27,000 staff to reset passwords in person, and exposed the data of up to 10 million customers. The hack succeeded entirely through social engineering: the attackers phoned a TfL help desk worker and persuaded them to reset a two-factor authentication code - a threat vector that trained, managed IT support with strict identity verification protocols addresses directly.
