Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack

The Scattered Spider group, known for sophisticated social engineering and identity-based attacks, compromised Transport for London by exploiting weaknesses in access control and human-layer defences rather than purely technical vulnerabilities. The breach disabled 148 systems, disrupted critical public services, and cost £29 million — demonstrating how devastating identity-focused attacks on large organisations can be. Scattered Spider's tactics typically involve SIM swapping, MFA fatigue bombing, and impersonating IT helpdesk staff to harvest credentials, meaning employees and helpdesk teams are often the primary attack surface. This case underscores that even well-resourced public infrastructure operators can be undone by insufficient identity verification procedures and inadequate insider-threat detection capabilities.