Transport for London: what an attack that never stopped the trains teaches cyber underwriters

Between 31 August and 3 September 2024 Scattered Spider broke into Transport for London's network: 148 systems down, 27,000 passwords reset in person, 29 million pounds in costs. The analysis: identity, public services, data, aggregation and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, September 2024 · by cybercoverinsurance

Between 31 August and 3 September 2024 two young members of the Scattered Spider group broke into the network of Transport for London (TfL), the body that runs public transport in the British capital. The Tube and buses kept running. But 148 internal systems became unusable, 27,000 employees had to turn up in person to reset their passwords, and some public services stayed down for months. TfL put its losses and recovery costs at 29 million pounds.

The case is useful for cyber underwriters for three reasons. It shows what it costs to rebuild the digital identity of a whole organisation. It shows how far the first estimate of stolen data can drift from the final one. And it shows the gap between the damage suffered and the damage narrowly avoided: according to the prosecution, a shutdown of the transport network could have cost the UK economy up to 56 billion pounds.

What is known

The attack. According to the National Crime Agency (NCA), TfL's network was breached between 31 August and 3 September 2024. The attackers were Thalha Jubair, from London, and Owen Flowers, from Walsall, described as leading members of Scattered Spider (NCA). Flowers was first arrested on 6 September 2024. According to the Crown Prosecution Service, at the same time he was attacking two US healthcare groups, SSM Health and Sutter Health (CPS).

Operational damage. The NCA reports 148 systems made unusable, several of them replaced for weeks by manual processes. The Dial-a-Ride service for disabled people, concessionary travel cards, the digital payments channel and the planned extension of contactless ticketing were all affected. The Oyster refund system was breached and the photocard application system for young people was closed. To contain the attack, TfL had to shut down part of its own network (CPS).

The data. At first TfL spoke of bank details of about 5,000 customers linked to Oyster refunds (The Register). In March 2026 a BBC investigation estimated that about 10 million people had names, addresses and contact details stolen. TfL sent notices to about 7.1 million customers. According to the same source, the Information Commissioner's Office closed the case in February 2025 without formal action (Tech Digest).

The trial. Jubair and Flowers were arrested again on 16 September 2025, pleaded guilty on 22 June 2026 and on 16 July 2026 were each sentenced to five years and six months. The NCA calls it the largest cyber crime prosecution ever brought before a UK court. The 29 million pound loss is the figure reported by TfL. Some articles report 39 million, without a primary source. The NCA has not published a breakdown of the costs.

What is not known. Neither the NCA nor the prosecution has said how the attackers got in. The group is known for social engineering against help desks, but for TfL this link does not appear in the public record.

Identity as a recovery cost

Resetting 27,000 passwords in person is a loss item, not a detail. When an attacker has had access to authentication systems, recovery means verifying every user's identity again. TfL did it by calling every employee into an office. That is lost working time, logistics costs and slower services, for weeks.

Policies cover restoration, but definitions need reading. Data and system restoration cover usually responds to the cost of returning systems to their pre-attack state. Internal staff time and manual workarounds are often covered only as extra expense, within sublimits. For an organisation with tens of thousands of staff, rebuilding identity can cost as much as the forensic investigation.

Improvements are not restoration. An organisation that adopts stronger authentication after an attack bears a cost that many policies exclude as betterment. The line between restoration and improvement should be clear before the claim.

A public body does not lose revenue, it loses services

Classic business interruption measures little. TfL kept trains and buses moving. The damage lay elsewhere: delayed refunds, cards not issued, social services blocked, a contactless extension project postponed. Cover calculated on lost margin captures this kind of loss poorly.

Extra expense is the line that matters. For public bodies and non-profits, the useful protection is on the additional costs of keeping services going: extra staff, manual processes, communications with citizens. Underwriting questions should ask which critical services can run by hand, for how long and at what cost.

Project delays are almost never covered. The delay in extending contactless is a real cost for TfL, but it rarely falls within interruption cover. It stays with the insured.

Data: the first estimate is not the final one

From 5,000 to 10 million. In September 2024 the public figure was about 5,000 customers with bank details. Eighteen months later the press estimate was about 10 million people with personal and contact data. The two figures measure different things, but the signal for underwriters is clear: the reserve for a data theft claim should not be set on the first press release.

Notifying millions of people has a measurable cost. TfL wrote to about 7.1 million customers. The cost of notices, support services and monitoring, when offered, grows with the number of people, not with the sensitivity of the data. An organisation with many registered customers has a high exposure even when the data is only basic personal information.

The regulator does not always fine. The ICO closing the case without formal action, according to Tech Digest, reduces the risk of penalties. It does not reduce the risk of customer claims, which remain possible in the UK.

The damage avoided and aggregation

56 billion pounds is a scenario, not a claim. The NCA reports the estimate that a shutdown of the transport network could have cost the UK economy up to 56 billion pounds. In chats between the two, cited by the prosecution, they talked about "nuking access" to TfL's systems (CPS). The attack did not get that far. But the case shows how close a systemic event can come, starting from an ordinary criminal intrusion.

Aggregation runs through insureds that depend on the public body. A prolonged transport shutdown in a capital city would hit thousands of businesses without any of them being breached. Dependent business interruption usually covers named IT suppliers, not public services. In this area real economic loss and insured loss diverge sharply.

One group, many sectors. While attacking TfL, Flowers was working against two US healthcare groups (CPS). The same actors, with the same techniques, hit different sectors within days. For a portfolio, aggregation does not run only through shared suppliers, but also through shared attackers.

What to bring to renewals

Impact for insurersHigh

An organisation with millions of registered customers and tens of thousands of staff adds up restoration, notification and manual service costs, even without lost revenue.

On the portfolio side, large public bodies and utilities are nodes on which many other insureds depend. A map of these dependencies, even just by sector and region, helps estimate the loss scenario the NCA described and that did not materialise in 2024.