Two teenagers who orchestrated a devastating cyberattack on Transport for London (TfL) in 2024 have been handed five-and-a-half-year prison sentences, delivering a significant blow to the notorious global hacking collective Scattered Spider. Owen Flowers, aged 18, and Thalha Jubair, 20, pleaded guilty earlier this year to orchestrating the attack that severely disrupted the capital's public transit system.
The cyber intrusion, which occurred in the summer of 2024, brought down critical TfL infrastructure, including the ticketing system and online real-time train arrival information. The disruptions persisted for several weeks, causing widespread inconvenience for commuters and an estimated £29 million in financial losses. According to reports, the hackers gained such deep access that they effectively held the 'keys to the kingdom', with the capability to completely shut down TfL's operations.
Flowers and Jubair were arrested a year after the attack, at which time the FBI had already implicated Jubair in over 120 company attacks, primarily employing social engineering tactics. Their sentencing was announced on Thursday, 11 July 2026, by UK police, who highlighted the significant impact of their conviction on Scattered Spider.
The National Crime Agency's National Cyber Crime Unit has described Scattered Spider as the most significant cybercrime threat to the UK in recent years. The unit's leader, Paul Foster, stated that through this investigation, authorities have 'severely disrupted that threat and brought key offenders to justice.' Scattered Spider, an amorphous group known for targeting employees rather than just computer systems, has been linked to numerous high-profile global attacks, including those against casino giant MGM, airline WestJet, and cybersecurity firm Okta.
The case serves as a stark reminder that some of the most effective hackers are not necessarily state-sponsored operatives but often young, intelligent individuals motivated by financial gain and notoriety within their peer groups. While cybercrime groups can rebrand and members may fluctuate, British authorities remain confident that the apprehension and jailing of Flowers and Jubair represent a critical setback for Scattered Spider's operations.