[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3RBBgqZ2zJLQqX9ySDTiwli7aRFJKFvsGcovb5YwEqw":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":66},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"eccb49fb-d182-4088-83c6-828dea11c7f2","Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack","two-scattered-spider-hackers-get-5-5-years-each-for-29-million-tfl-hack-8c402b","Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London. The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into an office to get their passwords reset in person. Both the NCA and the CPS put TfL's losses and recovery","Owen Flowers (18) and Thalha Jubair (20) were each sentenced to 5.5 years in prison for the August 2024 hack of Transport for London that affected 148 systems and caused £29 million in losses. The attack disabled critical services including Dial-a-Ride, contactless ticketing, and refund processing for 27,000 employees, forcing mass password resets. Both men pleaded guilty under Section 3ZA of the Computer Misuse Act 1990—reportedly the first successful UK prosecution under that section—and were identified as leading members of Scattered Spider (also tracked as Octo Tempest, UNC3944, and 0ktapus).","Two Scattered Spider hackers sentenced to 5.5 years for £29M Transport for London 2024 breach.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Ftwo-scattered-spider-hackers-get-55.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhcPDzKH0EAg764dc_I7qiwOAUUcWqBwDJcoojyb1-SwTOL5Gv24t1oGcIxnW8NkJjgXEadKJTIkcoN7nrFzrPk87AhHJj9Z5hPGk-vHGEkIppuyKJ-Sx_2M5aLF9z1VbD7G3uzf_kn_Wy1BYJ_R3RWwqM376W1hkWmfOdXYhlzCSqzSBRcJSbzGvFMkMg\u002Fs1600\u002FScattered-Spider.jpg","2026-07-16T17:09:25+00:00","2026-07-16T20:00:15.242446+00:00",8,[17,20,22,24,26],{"name":18,"type":19},"Scattered Spider","threat_actor",{"name":21,"type":19},"Octo Tempest",{"name":23,"type":19},"Owen Flowers",{"name":25,"type":19},"Thalha Jubair",{"name":27,"type":28},"Transport for London (TfL)","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":29,"icon":31,"name":32,"slug":33},null,"Breaches","breaches",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":51},{"id":52,"icon":31,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59],{"type":57,"value":21,"context":58},"malware","Alternative name for Scattered Spider threat group",{"type":57,"value":60,"context":61},"UNC3944","Mandiant tracking designation for Scattered Spider",[27],{"controls":64,"vendors":65},[],[],{"slug":67,"title":68,"body":69,"framework_refs":70,"framework_notes":87},"scattered-spider-hackers-jailed-for-29m-tfl-breach","Scattered Spider Hackers Jailed for £29M TfL Breach","The Scattered Spider group, known for sophisticated social engineering and identity-based attacks, compromised Transport for London by exploiting weaknesses in access control and human-layer defences rather than purely technical vulnerabilities. The breach disabled 148 systems, disrupted critical public services, and cost £29 million — demonstrating how devastating identity-focused attacks on large organisations can be. Scattered Spider's tactics typically involve SIM swapping, MFA fatigue bombing, and impersonating IT helpdesk staff to harvest credentials, meaning employees and helpdesk teams are often the primary attack surface. This case underscores that even well-resourced public infrastructure operators can be undone by insufficient identity verification procedures and inadequate insider-threat detection capabilities.",[71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST CSF ID.AM, PR.AC, DE.CM","MITRE ATT&CK T1621 (MFA Request Generation \u002F Fatigue)","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1534 (Internal Spearphishing)","UK Computer Misuse Act 1990 – Section 3ZA","NCSC Zero Trust Architecture Guidance","ITIL 4 – Service Desk Identity Verification Controls","GDPR Article 32 – Security of Processing",{}]