In 2024, the Scattered Spider cybercrime collective successfully breached Transport for London's network, causing significant disruption to internal systems and public services such as Dial-a-Ride, concessionary travel cards, digital payments, and contactless ticketing rollout. The attack rendered 148 systems inoperable and forced all 27,000 TfL employees to reset passwords in person. Customer data including names, addresses, and contact details were stolen. The financial impact on TfL was £29 million in losses and recovery costs, with officials estimating a potential £56 billion loss to the UK economy had the transport network been fully shut down. Two leading members of Scattered Spider were arrested and sentenced to five years and six months in prison after pleading guilty under the Computer Misuse Act. Law enforcement highlighted TfL's early cooperation as critical to the successful prosecution. The group was also implicated in numerous other cyberattacks and extortion campaigns targeting critical infrastructure and major organizations in the UK and US.

The attack caused widespread disruption to TfL's internal systems and public-facing services, including critical transportation and payment systems. It resulted in significant financial losses (£29 million) and operational impact, including the inoperability of 148 systems and mandatory password resets for all employees. Sensitive customer data was stolen, raising privacy and data protection concerns. The broader potential economic impact was estimated at up to £56 billion if the transport network had been fully disabled. The incident also led to law enforcement action and convictions against key threat actors, disrupting the cybercrime group’s activities.

No specific patch or remediation is indicated for this incident as it relates to a criminal intrusion rather than a disclosed software vulnerability. The vendor (TfL) cooperated early with law enforcement, which was credited as critical to the successful prosecution of the attackers. Organizations are encouraged to engage promptly with law enforcement if similarly targeted. General cybersecurity best practices and incident response readiness remain important but are not detailed in this report.