Two Scattered Spider Hackers Sentenced to 5.5 Years Each for £29 Million Cyberattack on Transport for London
Owen Flowers, 18, and Thalha Jubair, 20, received sentences of five and a half years in prison at Woolwich Crown Court on July 16, 2026. Their convictions stem from a significant cyberattack on Transport for London (TfL) that occurred in 2024, which has been described as one of the most severe cybercrimes in the UK, impacting a crucial public service and leading to considerable financial losses.
The Cyberattack and Its Impact
The cyber intrusion took place from August 31 to September 3, 2024, rendering 148 TfL systems inoperable. This disruption necessitated that all 27,000 employees of the transport authority reset their passwords in person, underscoring the extensive operational challenges created by the attack. The National Crime Agency (NCA) and the Crown Prosecution Service (CPS) estimated that the total losses and recovery costs for TfL amounted to approximately £29 million.
On June 22, 2026, just prior to the commencement of their trial, both Flowers and Jubair pleaded guilty to charges under Section 3ZA of the Computer Misuse Act 1990. This section represents the most serious offense under the Act, and the defendants acknowledged their recklessness in potentially causing significant harm to human welfare.
Legal Precedents and Implications
The CPS indicated that Flowers and Jubair are believed to be the first individuals successfully prosecuted under this specific section of the Computer Misuse Act. The NCA has classified this case as the largest cybercrime prosecution in UK history. The implications of this case extend beyond immediate sentencing, as it sets a legal precedent for future cybercrime cases.
The attack on TfL disrupted essential services, including the Dial-a-Ride program for vulnerable Londoners, digital payment systems, and the issuance of concessionary travel cards. The suspension of applications for Oyster photocards, which provide discounted fares for children and young people, further illustrated the widespread impact of the breach.
Technical Aspects of the Intrusion
TfL reported that names, email addresses, and home addresses were accessed during the breach. Additionally, sensitive data related to Oyster refunds, including bank account numbers and sort codes for approximately 5,000 individuals, may have been compromised. The NCA noted that had the attackers successfully shut down the network, it could have resulted in economic damages of up to £56 billion.
The investigation revealed that Flowers was arrested at home on September 6, 2024, shortly after the TfL intrusion concluded. During the arrest, NCA officers discovered that he was simultaneously targeting two U.S. healthcare organizations, SSM Health Care Corporation and Sutter Health. Investigators seized multiple devices, including laptops and hard drives, which contained evidence linking the pair to the TfL attack.
Broader Context: The Scattered Spider Group
Both Flowers and Jubair were identified as leading members of the cybercriminal group known as Scattered Spider, which has also been associated with other aliases such as Octo Tempest and UNC3944. The group is believed to have executed hundreds of attacks between 2022 and 2025, with the FBI linking them to various cybercrimes, including data extortion and SIM swapping.
In a separate ongoing case, Jubair faces additional charges in New Jersey for computer fraud, wire fraud, and money laundering conspiracies. This complaint alleges involvement in approximately 120 network intrusions affecting at least 47 U.S. victims, with ransom payments exceeding $115 million.
Future of Cybersecurity and Law Enforcement
The NCA stated that the arrests of Flowers and Jubair have significantly disrupted the operations of Scattered Spider, although it acknowledges that other criminals may continue to exploit the group’s brand. The case has prompted discussions about the necessity for enhanced cybersecurity measures and the importance of early reporting to law enforcement agencies.
Paul Foster, head of the NCA’s National Cyber Crime Unit, emphasized the need for organizations to report cyber incidents promptly, suggesting that the successful prosecution of Flowers and Jubair may not have been possible without TfL’s cooperation.
The City of London Police has also utilized this case to advocate for Cyber Crime Risk Orders, which would allow courts to impose restrictions on individuals’ access to devices and online services based on their risk profiles. Commander Ollie Shaw described these orders as a potential “digital prison” for offenders, highlighting the evolving landscape of cybersecurity legislation.
As the legal and technical ramifications of this case unfold, it serves as a stark reminder of the vulnerabilities faced by critical infrastructure and the ongoing battle against cybercrime.
For further details on this case, refer to the original reporting source: cyberwarriorsmiddleeast.com.
Explore the latest digital editions of FAME Delivered in the Magazine section: Magazine section
Published on 2026-07-17 05:33:00 • By FAME Delivered News Desk