Scattered Spider's Playbook Is Simple. Your Defense Needs to Be Simpler.

Sat, 04 Jul 2026 00:00:00 +0000

On June 22, 2026, Thalha Jubair, 20, and Owen Flowers, 18 — both from the UK — walked into Woolwich Crown Court and pleaded guilty on day one of a trial that had been set to run six weeks. Their target: Transport for London. Their tool: a phone call.

The attack, which ran August 31–September 3, 2024, exposed the personal data of an estimated 10 million people — names, email addresses, mobile numbers, and physical addresses — and forced all 28,000 TfL employees to travel to a TfL office in person to reset their passwords. Total losses and recovery costs: £29 million. Sentencing is scheduled for July 15, 2026.

Scattered Spider on CybersecurityOS

Scattered Spider's Playbook Is Simple. Your Defense Needs to Be Simpler.