Scattered Spider Duped TfL Helpdesk to Reset 2FA

UK authorities said two Scattered Spider members accessed Transport for London (TfL) by buying partial employee credentials and then tricking TfL’s helpdesk into resetting an employee password and 2FA. The attackers kept access for several days, escalated privileges, and ultimately exposed customer data and disrupted online services, costing TfL about £29 million to remediate.

Key findings

• Authorities said the attackers bought partial TfL credentials on criminal forums, then targeted account recovery to reset 2FA.
• They impersonated an employee and persuaded TfL helpdesk staff to reset a password.
• The attackers maintained access from Aug 31 to Sept 3, 2024 and worked to elevate privileges and reach key internal systems.
• TfL later said about 7 million users’ data was accessed, and remediation costs reached £29 million.
• The article explicitly links Scattered Spider to phishing, vishing, and social engineering as their common entry tactics.

Who’s being targeted

• Commonly targeted roles: IT Helpdesk / Service Desk, IT Operations, Security Operations (SOC), Identity & Access Management (IAM), All employees (especially remote workers).
• Affected industries: Public transportation, Government/public services, Healthcare (mentioned as other targets).
• Attack channels: vishing.
• Impersonated: TfL employee (legitimate staff member).

Awareness takeaways

• Helpdesk staff should require strong identity verification before any password or 2FA reset, especially when the request comes via phone.
• Treat repeated 2FA reset attempts as a high-risk signal and escalate to security for review before completing resets.
• Assume attackers may buy partial credentials on criminal forums; strengthen monitoring and controls around account recovery and “valid account” misuse.
• Engage law enforcement early during major incidents to improve the chances of identifying and prosecuting offenders.

Red flags to watch for

• Caller cannot verify identity using established checks but pressures for an immediate reset
• Repeated or multiple attempts to reset 2FA for the same account
• Request to bypass normal recovery steps or use an unusual method