In 2024, the Scattered Spider cybercrime group conducted a cyberattack targeting Transport for London, resulting in major disruptions and substantial financial damage. Two members, Jubair and Flowers, were arrested in 2025 and sentenced in 2026 to five years and six months imprisonment each. The UK National Crime Agency stated that these arrests effectively halted the group's criminal activities, a conclusion supported by independent assessments including Microsoft. Additional members of the group are facing prosecution in the US. The incident represents a significant law enforcement success against a major cybercriminal organization.

The cyberattack caused significant operational disruptions to Transport for London and financial losses totaling approximately £29 million ($39 million). The sentencing of key perpetrators has materially degraded the Scattered Spider group's ability to conduct further cybercriminal operations, effectively halting their activity. The broader impact includes disruption to public transportation services and associated economic costs.

The primary mitigation is law enforcement action resulting in the arrest and sentencing of key threat actors, which has effectively halted the group's operations. No technical patch or remediation is applicable. Organizations should remain vigilant for potential copycat activities but no new attacks from this group have been reported recently.