Scattered Spider attack on TfL affected 10 million people

The scale of the 2024 Scattered Spider cyber attack on Transport for London (TfL) was far wider in its scope than first imagined, with the personal data of millions of London’s bus, train and underground passengers affected, it has emerged.

According to the BBC, which has obtained and reviewed a copy of the database from an unnamed hacker, the data contained the names, email addresses, landline and mobile phone numbers, and street addresses of approximately 10 million people. Computer Weekly understands the copy of the database, which contained 15 million lines of data, has been destroyed.

Scattered Spider breached TfL’s systems in August 2024 – with the incident coming to light at the start of September – and forced TfL to pay millions in response and remediation costs, with the authority ultimately facing a bill of almost £40m.

It did not affect TfL’s ability to run its core services, but caused severe disruption to technical services such as third-party application programming interfaces (APIs) and public-facing Oyster services.

Two teenagers, since named as Owen Flowers and Thalha Jubair, appeared at Westminster Magistrate’s Court in September 2025 charged with offences relating to the incident. A full trial is set to take place later this year.

TfL told Computer Weekly it had widely publicised information on stolen data in September 2024 and kept customers informed throughout its investigation.

“The security of our systems and customer data is extremely important to us and we continually monitor our systems to ensure only those authorised can gain access and continue to take all the necessary actions to protect them,” said a spokesperson.

“At the time of the incident, we identified around 5,000 customers requiring support as we knew that some of their Oyster card refund data may also have been accessed, which could include bank account numbers and sort codes. As a precautionary measure, we contacted those customers directly as soon as possible to offer our support and the steps they could take.”

However, in disclosing the incident,, TfL also said it had only reached out to just over seven million individuals who had registered their email addresses with it, and about 40% of those emails were never opened, suggesting millions of people have no idea their data was leaked in the first place.

ESET’s Jake Moore said the most surprising element of the situation was less that millions of people were affected by the breach, but more that it took nearly 18 months for it to come to light.

“Ten million records is an incredibly valuable dataset for criminals, and when joined up to further previously exposed data, it becomes a treasure trove that is never deleted,” said Moore. 

“Even if the data hasn’t been actively abused yet, it’s highly likely that it will be traded and reused in scams for years.

“When millions of ordinary people rely on a service like this every day, the impact goes far beyond the organisation itself, which is why immediate transparency around the scale of a cyber attack is so important,” he said. “Anyone who had payment details linked to a TfL account should therefore continue to keep a close eye on their bank statements and remain cautious of any unexpected messages.”