Two Scattered Spider hackers sentenced to 5.5 years each for £29 million TfL hack
A British court has handed down prison sentences to two young members of the Scattered Spider hacking collective over the 2024 cyberattack on Transport for London (TfL). According to The Hacker News, Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on 16 July 2026.
The 2024 intrusion was one of the most disruptive attacks ever suffered by a UK public body. The breach reportedly left 148 TfL systems inoperable and forced the transport authority to reset credentials for its entire workforce — all 27,000 employees had to attend offices in person to have their passwords reset. The UK’s National Crime Agency and the Crown Prosecution Service put TfL’s losses and recovery costs at roughly £29 million.
The sentencing is a notable milestone in the broader crackdown on Scattered Spider, a loosely organized, largely English-speaking group of young cybercriminals linked to high-profile intrusions at companies on both sides of the Atlantic. The defendants’ ages — both were teenagers at the time of the attack — underscore a recurring theme in Scattered Spider prosecutions: significant real-world damage inflicted by very young offenders using social engineering and credential-theft techniques rather than sophisticated exploits.