Two members of the Scattered Spider cybercrime group received jail sentences in the UK for the 2024 cyberattack on Transport for London.

A UK court sentenced two Scattered Spider members, Thalha Jubair (20) and Owen Flowers (18), for their role in the 2024 cyberattack on Transport for London (TfL). Transport for London (TfL) is a local government body responsible for most of the transport network in London, United Kingdom.

The attack disrupted transport services, including Dial-a-Ride for vulnerable passengers, concessionary travel cards, digital payments, and the rollout of contactless ticketing. The attack also exposed customer data from the Oyster refunds system and delayed customer refunds and travel card applications.

All 27,000 employees had to reset their passwords, while 148 systems went offline, forcing staff to rely on manual processes.

The incident cost TfL an estimated £29 million ($39 million); however, the NCA reported that a complete shutdown could have caused up to £56 billion in economic damage.

The case marks another law enforcement success against one of the most active cybercrime groups targeting major organizations.

TfL estimates the attack cost £29 million, while a complete shutdown could have caused up to £56 billion in economic damage.

In September 2025, the National Crime Agency (NCA) arrested the two teenagers at their home addresses.

The law enforcement first arrested Flowers for the TfL attack, and investigators found evidence linking him to intrusions against U.S. healthcare providers SSM Health Care Corporation and Sutter Health. Authorities seized laptops, hard drives and USB devices, including one containing a screenshot of TfL network access.

Investigators also found videos showing Jubair accessing TfL systems during the attack while the two exchanged messages on Telegram and collaborated through an online workspace. Flowers was later arrested for breaching bail conditions, while Jubair faced additional charges for refusing to provide device passwords.

Both were charged with conspiring together to commit unauthorised acts against TfL, under the Computer Misuse Act.

“They both pleaded guilty to the attack last month in what was only the second criminal prosecution of its kind in the UK under the Computer Misuse Act (CMA).” reads the press release published by the NCA. “Section 3ZA of the CMA is the most serious section as it applies where the unauthorised act causes or creates a significant risk of serious damage, and the person intends or is reckless as to that damage.”

They were each sentenced to five years and six months in prison in what UK authorities described as the country’s largest cybercrime prosecution to date.

Although hackers continued using the Scattered Spider name into early 2026, UK authorities say the arrests of Jubair and Flowers effectively dismantled the group’s core operations. Microsoft also assessed that the arrests significantly reduced the group’s ability to carry out cyberattacks.

“Although other cybercriminals may continue to use the damaged Scattered Spider brand, the NCA’s action against Jubair and Flowers effectively halted the group’s criminal activity.” states NCA. “Independent assessment supports this, with Microsoft confirming that the arrests materially degraded the group’s ability to continue conducting cybercriminal operations.”

In July, Peter Stokes, 19, an alleged Scattered Spider member known online as “Bouquet,” was extradited from Finland to the U.S. to face hacking, fraud, and extortion charges. Prosecutors say he took part in multiple cyberattacks, including a 2025 breach of a luxury jewelry retailer where attackers allegedly stole data and demanded about $8 million in cryptocurrency.

“Among other offenses, the complaint alleges that Stokes and other co-conspirators breached a luxury jewelry retailer’s computer system, exfiltrated data from the company, and made a ransom demand of approximately $8 million in cryptocurrency in May 2025.” reads the press release published by DoJ. “The retailer’s security personnel successfully evicted the threat actors from the company’s computer network and no ransom was paid. The retailer nonetheless suffered a loss of at least $2 million due to business disruption, investigation, and mitigation of the threat.”

He was arrested in Finland in April on an Interpol Red Notice.

U.S. officials said Scattered Spider (aka Octo Tempest, UNC3944, and 0ktapus) has caused major disruption by targeting American companies, stealing data, encrypting systems, and demanding cryptocurrency payments. The FBI warned that the group has cost businesses millions of dollars and disrupted critical operations. Authorities pledged to continue working with international partners to identify, disrupt, and prosecute members of the group, regardless of where they operate.

The cybercrime group is suspected of hacking into hundreds of organizations over the past two years, including Twilio, LastPass, DoorDash, and Mailchimp.

Scattered Spider members are part of a broader cybercriminal community called “The Com,” where hackers brag about high-profile cyber thefts, typically initiated through social engineering tactics like phone, email, or SMS scams to gain access to corporate networks.

In April 2026, Tyler Buchanan, a 24-year-old from Scotland, also linked to the Scattered Spider group, admitted in a US court that he hacked dozens of companies, committed fraud, and stole millions in cryptocurrency. Spanish police arrested the British national in Palma de Mallorca while attempting to fly to Italy. During the arrest, police confiscated a laptop and a mobile phone. The arrest resulted from a joint operation conducted by the U.S. Federal Bureau of Investigation (FBI) and the Spanish Police.

In April 2025, Noah Urban, 20, linked to Scattered Spider (UNC3944), pleaded guilty in Florida and California to conspiracy, wire fraud, and identity theft. He admitted involvement in phishing and fraud operations, including stealing at least $800,000 in crypto from victims between Aug 2022 and Mar 2023. He also helped export stolen data and run multi-state cybercrime activities tied to the group.

In November 2025, two British teenagers, Thalha Jubair (19) and Owen Flowers (18), accused of links to Scattered Spider, pleaded not guilty in Southwark Crown Court to charges under the Computer Misuse Act. They are alleged to have conspired in a cyberattack against Transport for London (TfL) in 2024. Both were arrested in September by the NCA and formally denied the accusations in court.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

Nearly two years after a cyberattack disrupted Transport for London’s (TfL) online services and exposed customer data, two…

Alleged Scattered Spider member Peter Stokes, 19, was extradited from Finland to the U.S. over hacking, fraud, and extortion charges.

Peter Stokes, 19, an alleged Scattered Spider member known online as “Bouquet,” has been extradited from Finland to the U.S. to face hacking, fraud, and extortion charges. Prosecutors say he took part in multiple cyberattacks, including a 2025 breach of a luxury jewelry retailer where attackers allegedly stole data and demanded about $8 million in cryptocurrency.

“Among other offenses, the complaint alleges that Stokes and other co-conspirators breached a luxury jewelry retailer’s computer system, exfiltrated data from the company, and made a ransom demand of approximately $8 million in cryptocurrency in May 2025.” reads the press release published by DoJ. “The retailer’s security personnel successfully evicted the threat actors from the company’s computer network and no ransom was paid. The retailer nonetheless suffered a loss of at least $2 million due to business disruption, investigation, and mitigation of the threat.”

He was arrested in Finland in April on an Interpol Red Notice.

U.S. officials said Scattered Spider (aka Octo Tempest, UNC3944, and 0ktapus) has caused major disruption by targeting American companies, stealing data, encrypting systems, and demanding cryptocurrency payments. The FBI warned the group has cost businesses millions of dollars and disrupted critical operations. Authorities pledged to continue working with international partners to identify, disrupt, and prosecute members of the group, regardless of where they operate.

The cybercrime group is suspected of hacking into hundreds of organizations over the past two years, including Twilio, LastPass, DoorDash, and Mailchimp.

Scattered Spider members are part of a broader cybercriminal community called “The Com,” where hackers brag about high-profile cyber thefts, typically initiated through social engineering tactics like phone, email, or SMS scams to gain access to corporate networks.

“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “The charges unsealed today are the result of years of work by the Criminal Division, the U.S. Attorney’s Office for the Northern District of Illinois, and the FBI. We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States.”

The case is part of the FBI’s Operation Riptide, a long-term effort to disrupt cybercriminals, their infrastructure, and financial networks. Americans reported more than $20 billion in cybercrime losses last year, up 26% from the previous year.

In April 2026, Tyler Buchanan, a 24-year-old from Scotland, also linked to the Scattered Spider group, admitted in a US court that he hacked dozens of companies, committed fraud, and stole millions in cryptocurrency. Spanish police arrested the British national in Palma de Mallorca while attempting to fly to Italy. During the arrest, police confiscated a laptop and a mobile phone. The arrest resulted from a joint operation conducted by the U.S. Federal Bureau of Investigation (FBI) and the Spanish Police.

In April 2025, Noah Urban, 20, linked to Scattered Spider (UNC3944), pleaded guilty in Florida and California to conspiracy, wire fraud, and identity theft. He admitted involvement in phishing and fraud operations, including stealing at least $800,000 in crypto from victims between Aug 2022 and Mar 2023. He also helped export stolen data and run multi-state cybercrime activities tied to the group.

In November 2025, two British teenagers, Thalha Jubair (19) and Owen Flowers (18), accused of links to Scattered Spider, pleaded not guilty in Southwark Crown Court to charges under the Computer Misuse Act. They are alleged to have conspired in a cyberattack against Transport for London (TfL) in 2024. Both were arrested in September by the NCA and formally denied the accusations in court.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

An alleged member of the Scattered Spider cybercrime group has been extradited from Finland to the United States to face federal charges related to conspiracy, cyber intrusion, and fraud. U.S. authorities said the case marks another step in their ongoing efforts to prosecute individuals accused of participating in high-profile cybercrime operations linked to the notorious hacking group.

Peter Stokes, 19, a dual U.S. and Estonian citizen, made his initial appearance in federal court in Chicago after being extradited from Finland.

According to the U.S. Department of Justice, Stokes was arrested by Finnish authorities in April following an Interpol Red Notice and was transferred to the United States last week. A criminal complaint filed in the Northern District of Illinois accuses him of participating in cyberattacks carried out as part of the Scattered Spider group.

Scattered Spider Linked to More Than 100 Network Intrusions

According to the complaint, Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, has been associated with more than 100 network intrusions. Authorities allege the group's activities have resulted in over $100 million in ransom payments and millions of dollars in additional damages suffered by victims.

Investigators said the group targeted companies across the United States by obtaining access to employee accounts through fraudulent methods.

Once inside corporate networks, the attackers allegedly encrypted data or exfiltrated sensitive information to remote servers before demanding cryptocurrency payments to restore access or prevent the public release of stolen data.

Complaint Details Alleged Luxury Retailer Cyberattack

The criminal complaint describes an alleged cyber intrusion that occurred in May 2025 involving a luxury jewelry retailer.

Federal prosecutors allege that Stokes and other co-conspirators breached the retailer's computer systems, exfiltrated company data, and demanded approximately $8 million in cryptocurrency as ransom. According to court documents, the retailer's security team successfully removed the threat actors from its network before any ransom payment was made.

Although the company did not pay the ransom, authorities said it still incurred losses of at least $2 million due to business disruption, investigation costs, and mitigation efforts following the incident.

Operation Riptide Targets Cybercrime Networks

The extradition and criminal charges were announced by the Department of Justice, the U.S. Attorney's Office for the Northern District of Illinois, and the FBI. The investigation also involved the FBI's Copenhagen Law Enforcement Attaché Office, the FBI Las Vegas Field Office, the Justice Department's Office of International Affairs, and Finland's National Bureau of Investigation.

Officials said the case forms part of Operation Riptide, an ongoing FBI campaign focused on disrupting cybercriminal actors, infrastructure, financial networks, and fraud schemes targeting Americans.

According to the FBI, Americans reported more than $20 billion in cybercrime losses last year, representing a 26% increase compared with the previous year.

Authorities Cite International Cooperation

Assistant Attorney General A. Tysen Duva said the charges stem from years of investigative work by the Justice Department, the U.S. Attorney's Office, and the FBI, adding that authorities would continue working together to pursue cybercriminals operating across international borders.

U.S. Attorney Andrew S. Boutros said the alleged attacks caused significant disruption to businesses across the United States and emphasized the government's commitment to prosecuting individuals involved in cyber intrusions.

FBI Special Agent-in-Charge Douglas S. DePodesta also highlighted the role of international law enforcement partnerships in identifying alleged members of the hacking group and pursuing cross-border cybercrime investigations.

Recent Guidance on Scattered Spider Threat

The arrest follows recent law enforcement efforts targeting the Scattered Spider threat group. In July 2025, the FBI and CISA released updated guidance describing the group's latest attack techniques, including the use of DragonForce ransomware to encrypt VMware ESXi servers.

The advisory urged organizations to maintain isolated offline backups, implement phishing-resistant multifactor authentication (MFA), and apply application controls to manage software execution.

Separately, in November 2025, two alleged Scattered Spider members appeared before Southwark Crown Court in the United Kingdom and pleaded not guilty to charges related to the August 2024 cyberattack on Transport for London (TfL).

The Department of Justice emphasized that the complaint against Stokes contains allegations only. As with all criminal cases, he is presumed innocent unless and until proven guilty in court.

Aflac says a data breach in Japan may affect 4.38 million customers and agents, exposing personal, policy, and some banking information.

The post Aflac Data Breach: Over 4M Customers in Japan May Be at Risk appeared first on TechRepublic.

Two alleged members of the cybercrime collective Scattered Spider have pleaded guilty to their roles in the Transport for London cyberattack, an incident that disrupted services, exposed customer data, and resulted in approximately £29 million in losses and recovery costs for London's transport authority. The guilty pleas were entered by Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, West Midlands, on the opening day of proceedings at Woolwich Crown Court. The pair had been due to stand trial on June 22 but changed their pleas to guilty.

Transport for London Cyberattack Led to Major Disruption

According to the National Crime Agency (NCA) and City of London Police, TfL's network was infiltrated between August 31 and September 3, 2024. The breach forced all 28,000 employees to attend TfL offices for password resets and caused significant operational disruption across the organization. The TfL cyberattack also resulted in unauthorized access to data held within TfL's Oyster refunds system. The incident affected the authority's customer refund process, delaying reimbursements for some customers. In addition, the application system for Oyster photocards used by children and young people was temporarily shut down. Authorities said the attack caused substantial financial damage, with TfL reporting losses and recovery costs totaling approximately £29 million.

Investigation Linked Attackers to Scattered Spider

Jubair and Flowers were arrested at their homes on September 16, 2024, following a joint investigation conducted by the NCA and City of London Police. Investigators identified both individuals as members of Scattered Spider, a cybercriminal collective that has been linked to a number of high-profile intrusions. During searches of Flowers' residence, officers recovered laptops, desktop computers, hard drives, and USB storage devices. Evidence recovered from one Acer laptop included a screenshot showing connectivity to TfL infrastructure. [caption id="attachment_112868" align="aligncenter" width="600"] Source: NCA[/caption] Authorities also found evidence indicating Flowers had accessed an online marketplace that sold breached credentials. Investigators further discovered videos recorded by Flowers that allegedly showed Jubair accessing TfL systems during the attack. The investigation revealed that the two communicated through Telegram and collaborated using an online workspace platform that allowed multiple participants to work remotely on shared systems.

Additional Allegations Involving US Healthcare Networks

The investigation extended beyond the Transport for London cyberattack. When Flowers was first arrested on September 6, 2024, NCA officers identified evidence suggesting unauthorized activity targeting the networks of SSM Health Care Corporation and Sutter Health in the United States. Court records show Flowers pleaded guilty to charges related to a conspiracy to conduct unauthorized acts against SSM Health Care Corporation's computer systems with intent to impair operations. He also admitted attempting unauthorized acts against Sutter Health's systems with the same intent. Jubair additionally faced a charge for failing to disclose PINs or passwords associated with devices seized during the investigation. Authorities noted that Flowers breached bail conditions on two occasions in March and May 2025.

Law Enforcement Highlights Impact of Cybercrime

Paul Foster, Deputy Director and head of the NCA's National Cyber Crime Unit, described the case as a lengthy and highly complex investigation. He said the attack demonstrated that cybercrime has significant real-world consequences, affecting public services and causing millions of pounds in losses to critical national infrastructure. Foster also highlighted the growing threat posed by cybercriminal groups operating from the UK and other English-speaking countries, citing Scattered Spider as a notable example. Deputy Commissioner Nik Adams of the City of London Police said the cyberattack had a significant impact on essential public services and daily operations. He emphasized that individuals responsible for targeting critical organizations and causing financial harm would be pursued through coordinated law enforcement efforts. The investigation received support from the West Midlands Regional Organised Crime Unit and British Transport Police. Jubair and Flowers are scheduled to be sentenced at Woolwich Crown Court on July 16.

Two teenagers face sentencing after admitting to a massive Scattered Spider cyberattack that hit Transport for London (TfL) and US healthcare networks.

Here's a tip for you all. Unless you want to draw attention to yourself as a cybercriminal, don't flaunt your diamond-encrusted "HACK THE PLANET" necklace on Snapchat, or pose as a Sopranos crime boss while the FBI is reportedly closing in. Read more in my article on the Hot for Security blog.

US-Estonian suspect Peter Stokes arrested in Finland over alleged ties to Scattered Spider, facing US charges for cyberattacks, fraud, and data breaches.

Tyler Robert Buchanan, a 24-year-old British hacker linked to Scattered Spider, admits to a multi-year US hacking scheme involving at least $8M in crypto theft.