Two British cybercriminals from the notorious Scattered Spider hacking group have pleaded guilty to the 2024 cyber-attack on Transport for London that cost the organisation £39 million, disrupted services for millions of passengers and exposed sensitive customer data including Oyster card refund information and bank account details.
The guilty pleas, reported by The Guardian on 22 June 2026 and confirmed by cybersecurity firm CyPro on 23 June, mark a significant moment in the UK’s effort to prosecute domestic cybercriminals who have operated with relative impunity by targeting large organisations through social engineering rather than technical exploits.
How the Attack Unfolded
The September 2024 attack on TfL was carried out using a technique known as “MFA fatigue” — bombarding an employee with authentication requests until they approved one, granting the attackers access to internal systems. Once inside, the hackers accessed sensitive data and caused disruption to TfL’s customer-facing systems, including the Oyster card refund portal, which had to be taken offline for several weeks.
The attack affected approximately 5,000 customers whose bank account details were potentially accessed. TfL was forced to implement manual processes for customer service operations and spent months rebuilding its security infrastructure. The total cost of £39 million includes the direct cost of the attack, remediation, customer compensation and the implementation of enhanced security measures.
Scattered Spider: A British Connection
Scattered Spider — also known as UNC3944 or Octo Tempest — is a loosely affiliated group of English-speaking cybercriminals, predominantly young British and American men, who have carried out high-profile attacks on MGM Resorts, Caesars Entertainment and multiple other major organisations. The group’s use of native English and deep knowledge of corporate IT helpdesk procedures has made them particularly effective at social engineering attacks.
The guilty pleas are expected to result in custodial sentences. The case is being watched closely by the UK’s National Cyber Security Centre as a test of whether domestic prosecution can deter a new generation of cybercriminals who operate in the grey zone between organised crime and hacktivism.
