2024-08-31 (incident) · GB · Transport for London

Transport for London hacked after a help desk password reset, 2024

Sentence handed down.

Between 31 August and 3 September 2024, attackers infiltrated Transport for London's network, rendering more than 140 systems inoperable, accessing Oyster refunds data and costing TfL a reported £29 million. The Register reported that Woolwich Crown Court heard the attackers impersonated an employee and socially engineered a TfL helpdesk worker into resetting a password. Thalha Jubair, described by the NCA as a member of Scattered Spider, pleaded guilty along with a second defendant, a minor at the time of the attack, and each was sentenced to five years and six months.

£29M (impact, about $39M; Loss and recovery costs reported by the NCA and CPS; US dollar figure as converted by The Register ($39 million).)

Timeline

1. 2024-08-31 Attackers gain access to TfL's network and hold it until 3 September.
2. 2024-09-06 A co-defendant, a minor at the time, is first arrested over the attack.
3. 2025-09-16 The NCA and City of London Police arrest Thalha Jubair and the co-defendant at their homes.
4. 2026-06-22 Jubair and the co-defendant change their pleas to guilty on the day their trial is due to start at Woolwich Crown Court.
5. 2026-07-16 Jubair and the co-defendant are each sentenced to five years and six months in prison.

Lessons

• Make the help desk verify identity with something an attacker cannot buy or research before resetting a password or MFA.
• Engage law enforcement early: the NCA said the convictions would likely not have been possible without TfL doing so.
• Be ready to reset every employee's credentials at scale; TfL had to have staff attend an office in person for password resets.

Scam types: Help desk password and MFA reset impersonation

Sources

1. NCA: Two sentenced for hacking Transport for London in UK's biggest ever cyber crime case (Law enforcement, primary, accessed 2026-09-24)
2. NCA: Cyber criminals who hacked into Transport for London's computer network are convicted (Law enforcement, primary, accessed 2026-09-24)
3. CPS: Cyberhackers who targeted TfL jailed for more than five years each (Law enforcement, primary, accessed 2026-09-24)
4. The Register: Brit Scattered Spider duo handed tickets to prison over Transport for London attack (News report, secondary, accessed 2026-09-24)