Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Transport for London (TfL) hit by cyberattack

Incident
First reported
Last updated
Happening score
H score 49
4 unique sources, 5 articles

Summary

Hide ▲

The August 2024 cyber attack on Transport for London (TfL) caused significant disruption and £29m ($38m) in loss and recovery costs. The intrusion affected the customer refund system, disabled the Oyster photocard application system for children and young people, and forced 28,000 employees to reset passwords at a TfL office. Law enforcement later linked the case to alleged Scattered Spider members Thalha Jubair and Owen Flowers, who pleaded guilty in June 2026.

Related Happenings

Transport for London (TfL) customer data exposed after Transport for London (TfL) breach

Data Leak
H score46 First: 23.06.2026 18:31 Last: 23.06.2026 18:31 Sources 1

How related: On September 12, TfL admitted that customer data had been stolen in the attack, while the U.K.’s National Crime Agency (NCA) announced on the same day the arrest of Flowers, a suspect at the time.

About this happening: The **Transport for London (TfL)** intrusion became a confirmed **data leak** after **customer data** was stolen from the **Oyster refunds system**, raising misuse risk for affect...

Open Happening

Finnish arrest and U.S. charges in Bouquet Scattered Spider case

Law Enforcement
H score45 First: 28.04.2026 18:39 Last: 28.04.2026 18:39 Sources 1

About this happening: **Finnish law enforcement** arrested **Bouquet**, and **U.S. federal prosecutors** later charged him in a cross-border **Scattered Spider** cybercrime case. The charges include **...

Open Happening

DoJ/FBI/USSS crypto-fraud domain seizure and charges

Law Enforcement
H score33 First: 27.04.2026 18:00 Last: 27.04.2026 18:00 Sources 1

About this happening: **DoJ**, **FBI**, and **US Secret Service** investigators **seized 503 domains** linked to **fraudulent crypto platforms**, disrupting infrastructure used in a Cambodia-based scam...

Open Happening

NCA and City of London Police Operation Henhouse fraud arrests and seizures

Law Enforcement
H score73 First: 25.03.2026 11:35 Last: 25.03.2026 11:35 Sources 1

About this happening: The latest **Operation Henhouse 5** produced **557 arrests** and major asset disruption in a **UK fraud crackdown** led by the **NCA** and **City of London Police**. Officers also...

Open Happening

UK government fraud reporting service and Online Crime Centre

Public Sector Action
H score78 First: 25.03.2026 11:35 Last: 25.03.2026 11:35 Sources 1

About this happening: The **UK government** launched a **national fraud reporting service** and refreshed its fraud strategy with a new **Online Crime Centre**, strengthening coordination against **cyb...

Open Happening

Timeline

  1. 19.09.2025 10:05 6 articles · 9mo ago

    U.K. arrests linked to August 2024 TfL cyber attack

    Legal Policy Action Update

    U.K. authorities arrested Thalha Jubair and Owen Flowers at their home addresses in connection with an August 2024 cyber attack on Transport for London (TfL); the National Crime Agency said the attack caused significant disruption and millions in losses to TfL, part of the UK's critical national infrastructure.

    Show sources
    Open in new tab