Scattered Spider Hackers Sentenced for 2024 TfL Cyberattack Two key members of the Scattered Spider cybercrime group, 20-year-old Thalha Jubair and 18-year-old Owen Flowers, were sentenced to five years and six months in prison each for their roles in the August 2024 hack of Transport for London (TfL). The attack disrupted critical services, including Dial-a-Ride, digital payments, contactless ticketing, and refund processing, while rendering 148 systems inoperable and forcing 27,000 TfL employees to reset passwords in person. The breach, disclosed by TfL on September 2, 2024, also exposed customer data, including names, addresses, and contact details. Financial losses for TfL reached £29 million, with officials warning that a full network shutdown could have cost the UK economy up to £56 billion. Owen Flowers was arrested on September 16, 2024, alongside Jubair, after authorities linked him to ongoing attacks on U.S. healthcare providers Sutter Health and SSM Health Care Corporation. Evidence seized from Flowers included proof of the TfL intrusion. Both pleaded guilty under the Computer Misuse Act. The UK National Crime Agency (NCA) called Scattered Spider "the most significant cybercrime threat to the UK in recent years", crediting TfL’s early cooperation with law enforcement for the convictions. Meanwhile, the U.S. Department of Justice charged Jubair in September 2025 with conspiracy, computer fraud, money laundering, and wire fraud, alleging involvement in 120 breaches between May 2022 and September 2025, including attacks on U.S. critical infrastructure and courts. The group is accused of extorting over $115 million from global victims between August 2024 and July 2025. In July 2025, the NCA arrested four additional suspected Scattered Spider members in connection with cyberattacks on major UK retailers, including Harrods, Marks & Spencer, and Co-op.

The Maine Office of the Attorney General reported a data breach involving Crossmark, Inc. on April 15, 2024. The breach occurred on March 15, 2024, due to an inadvertent disclosure of personal information, specifically a spreadsheet containing names and Social Security numbers, affecting a total of 1,295 individuals.