The 2024 cyberattack on Transport for London cost the organisation £29 million, disabled 148 systems, and required all 27,000 employees to attend an office for a password reset, turning a breach of digital trust into months of operational recovery across the capital’s transport authority.

Thalha Jubair, 20, and Owen Flowers, 18, were each sentenced to five years and six months at Woolwich Crown Court on 16 July after pleading guilty to the attack. The National Crime Agency described both as leading members of the online criminal collective known as Scattered Spider.

The pair infiltrated TfL’s network between 31 August and 3 September 2024. Rapid intervention prevented the transport network itself from being shut down, although the intrusion disrupted Dial-a-Ride bookings, concessionary travel card issuance, digital payments, customer refunds, and a planned extension of contactless ticketing.

Information from the Oyster refund system was accessed, while manual workarounds were required for services whose supporting technology became unavailable. Customer service, finance, accessibility teams, operational managers, and employees across the organisation had to work around systems that could no longer be trusted.

The prosecution used section 3ZA of the Computer Misuse Act, which applies when an unauthorised act causes, or creates a significant risk of, serious damage and the offender intends or is reckless as to that harm. The NCA said the case was only the second UK prosecution under that provision.

Investigators recovered devices, videos, and screenshots showing connectivity to TfL systems. British transport and regional police forces worked alongside US authorities, reflecting the distributed membership and infrastructure used by the group.

Containment was only the beginning

The £29 million figure illustrates why the financial impact of a cyberattack cannot be measured through stolen data or ransom payments alone. TfL had to investigate the intrusion, contain access, rebuild confidence in accounts and devices, restore applications, support manual processes, communicate with customers, and postpone other work while specialist staff concentrated on recovery.

Requiring every employee to reset a password in person may have been necessary to establish identity, but it exposed the logistical consequences of losing confidence in central authentication. Large employers with contractors, remote staff, shift workers, and dispersed sites need a workable method for verifying people when email, self-service portals, and telephone support can no longer be trusted.

Scattered Spider has become associated with social engineering, SIM swapping, help desk impersonation, and misuse of legitimate remote access procedures. Those methods exploit processes designed to help genuine employees recover quickly after losing a device, changing a telephone number, or forgetting a credential.

An attacker does not need to break encryption or discover an unknown software flaw when a support process can be persuaded to issue access. Phishing resistant authentication, restrictions on privileged resets, stronger checks for changes to multifactor devices, and separation between support staff and high impact administrative actions can reduce the exposure.

Controls still have to work for real employees. A process so rigid that nobody can recover access during travel, device loss, or an emergency will be bypassed or weakened by staff trying to keep the organisation running. Security design has to resist attackers while supporting legitimate recovery under pressure.

Public infrastructure adds another difficulty because service continuity takes precedence. TfL could not close every connected system for forensic convenience, nor could it tolerate indefinite uncertainty over customer information and employee accounts. Recovery proceeded while buses, trains, accessibility services, staffing, payments, and other operations continued across London.

The NCA estimated that a complete shutdown of the transport network could have cost the UK economy as much as £56 billion. Any counterfactual estimate carries uncertainty, but the figure captures how the economic value of critical infrastructure extends beyond the operator’s own revenue and balance sheet.

Disrupted transport affects employers, suppliers, schools, hospitals, public services, and millions of journeys. A risk model based only on TfL’s direct financial exposure would therefore understate the concentration of economic activity around its technology.

Backups are necessary but insufficient when an attacker has entered through a trusted identity. Organisations may need to review every account, device, integration, token, and administrative action created during the period of compromise, while proving that restored systems have not inherited the attacker’s access.

The prison sentences close the criminal case against two participants without reducing the operational lesson. Critical service operators need a rehearsed method for rebuilding digital trust, because restoring servers is only one part of recovering from an intrusion that turns legitimate credentials and support procedures against the organisation.