Everything we know as Walsall hacker faces jail over Transport for London cyber attack

A Walsall hacker is preparing to receive his sentence for his role in a multi-million-pound hack on the Transport for London (TfL) network.

The attack, carried out between August 31 and September 3, 2024, saw Owen Flowers, aged 18, from Walsall, and Thalha Jubair, aged 20, from East London, infiltrate the TfL system under the name of the ‘Scattered Spider’ group.

The pair compromised the TfL’s network, forcing all 28,000 employees to attend a TfL office to receive a password reset.

During the attack, the rail group’s Oyster refund system was also accessed, leaving many out of pocket for longer periods than usual.

Now, the duo are due to appear at Woolwich Crown Court today (July 15) for sentencing.

Scattered Spider

Scattered Spider is described as a loose online criminal collective of English-speaking hackers and scammers, all with a focus on extorting and stealing valuable information from businesses or employees for financial gain.

The hacker group has previously been linked to attacks on Caesars Entertainment in 2023 and on MGM Resorts on September 11, 2023.

The group goes by a number of names online, including UNC3944, Temptest, Octo Tempest, and, more recently, ShinyHunters, and is believed to be affiliated with the larger cybercriminal network, ‘The Com’ or ‘The Community’.

Scattered Spider is notorious for its use of social engineering techniques to gain access to the victim’s systems and commonly utilises phishing emails, fake calls/text messages, and even calling up help desks with stolen credentials.

The group is known to mostly rely on complex pre-built software purchased on the dark web, meaning that members don’t usually require vast technological knowledge to launch their attacks.

TfL attack.

The TfL network was infiltrated between August 31 and September 3, 2024, with the attack forcing all 28,000 employees to go to their nearest office for a password reset.

Refunds for some customers were also delayed, with applications for Oyster photocards for children and young people also being shut down at the time.

The attack is said to have cost an estimated £39m.

It is thought that the pair used social engineering methods to gain access to TfL’s systems, relying on the human error of the transport group's staff rather than complex software.

Arrests

Owen Flowers was arrested at his Walsall home on September 6, 2024, at which point the National Crime Agency (NCA) further identified evidence that the networks of the US healthcare companies, SSM Health Care Corporation and Sutter Health, had also been attacked and infiltrated.

During the arrest, investigators also found a number of devices in his home, including laptops, tower computers, hard drives and USB sticks.

One Acer laptop contained a screenshot showing network connectivity to the TfL systems.

Flowers was also found to have accessed an online tool that was selling breached credentials.

Another laptop also contained a number of videos that Flowers had recorded, showing Jubair accessing TfL systems during the attack, with the pair messaging each other over Telegram at the same time.

Both Flowers and Jubair pleaded guilty to the cyber attack when they appeared at Woolwich Crown Court last month.

Now, the pair are back in court today to face sentencing for their crimes.